- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h arch/x86/kernel/cpu/microcode/amd.c [move the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/include/asm/cpu.h | 12 ++++++++++ arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++ arch/x86/kernel/cpu/microcode/amd.c | 12 ---------- 3 files changed, 47 insertions(+), 12 deletions(-) diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h index 43a228e11209..d252aa7f04fb 100644 --- a/arch/x86/include/asm/cpu.h +++ b/arch/x86/include/asm/cpu.h @@ -84,4 +84,16 @@ int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type); extern struct cpumask cpus_stop_mask; +union zen_patch_rev { + struct { + __u32 rev : 8, + stepping : 4, + model : 4, + __reserved : 4, + ext_model : 4, + ext_fam : 8; + }; + __u32 ucode_rev; +}; + #endif /* _ASM_X86_CPU_H */ diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index b6990dc26274..75746a991f8e 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -96,18 +96,6 @@ static struct equiv_cpu_table { struct equiv_cpu_entry *entry; } equiv_table; -union zen_patch_rev { - struct { - __u32 rev : 8, - stepping : 4, - model : 4, - __reserved : 4, - ext_model : 4, - ext_fam : 8; - }; - __u32 ucode_rev; -}; - union cpuid_1_eax { struct { __u32 stepping : 4, -- 2.34.1

2 1

[PATCH OLK-5.10] fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
by Jiacheng Yu 06 Feb '26

06 Feb '26

From: Sravan Kumar Gundu <sravankumarlpu(a)gmail.com> mainline inclusion from mainline-v6.17-rc1 commit af0db3c1f898144846d4c172531a199bb3ca375d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9085 CVE: CVE-2025-38685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs(). Reported-and-tested-by: syzbot+c4b7aa0513823e2ea880(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c4b7aa0513823e2ea880 Signed-off-by: Sravan Kumar Gundu <sravankumarlpu(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Conflicts: drivers/video/fbdev/core/fbcon.c [Context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 81bf4f7bd9e8..66ecb2a044c6 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -827,7 +827,8 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info, fg_vc->vc_rows); } - update_screen(vc_cons[fg_console].d); + if (fg_console != unit) + update_screen(vc_cons[fg_console].d); } /** @@ -1366,6 +1367,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, struct vc_data *svc; struct fbcon_ops *ops = info->fbcon_par; int rows, cols, charcnt = 256; + unsigned long ret = 0; p = &fb_display[unit]; @@ -1417,11 +1419,10 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= vc->vc_font.width; rows /= vc->vc_font.height; - vc_resize(vc, cols, rows); + ret = vc_resize(vc, cols, rows); - if (con_is_visible(vc)) { + if (con_is_visible(vc) && !ret) update_screen(vc); - } } static __inline__ void ywrap_up(struct vc_data *vc, int count) -- 2.43.0

2 1

[PATCH OLK-5.10] Revert "!19950 [OLK-5.10] Drivers GPU Patches from 6.6"
by Tengda Wu 06 Feb '26

06 Feb '26

This reverts commit 84c1c0818c45cdfbbaa4b5ba4b8a552a52f5760e, reversing changes made to 67fd5a0f7d0f1baceab00f0d3901a94803f0aee1. Commit 70dcc68078ac introduced a null-pointer dereference exception, causing kernel boot failure: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 Call trace: hibmc_debugfs_init+0x38/0x68 [hibmc_drm] hibmc_pci_probe+0xdc/0x1ac [hibmc_drm] local_pci_probe+0x48/0xb0 work_for_cpu_fn+0x24/0x50 process_one_work+0x1d8/0x4c0 worker_thread+0x25c/0x470 kthread+0x108/0x150 Temporarily revert the entire associated patch series as a precautionary measure to circumvent the issue. Fixes: 70dcc68078ac ("drm/hisilicon/hibmc: hibmc-drm bugfix for DP") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/gpu/drm/drm_connector.c | 9 - drivers/gpu/drm/drm_internal.h | 2 - drivers/gpu/drm/drm_probe_helper.c | 29 -- drivers/gpu/drm/drm_sysfs.c | 17 +- drivers/gpu/drm/hisilicon/hibmc/Kconfig | 2 - drivers/gpu/drm/hisilicon/hibmc/Makefile | 4 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c | 167 ------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 73 --- .../gpu/drm/hisilicon/hibmc/dp/dp_config.h | 21 - drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 338 -------------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 74 ---- drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 415 ------------------ drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 140 ------ .../gpu/drm/hisilicon/hibmc/dp/dp_serdes.c | 59 --- .../drm/hisilicon/hibmc/hibmc_drm_debugfs.c | 149 ------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 257 ----------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 127 ++---- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 31 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 48 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 60 +-- include/drm/drm_probe_helper.h | 3 - 21 files changed, 79 insertions(+), 1946 deletions(-) delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c index fa9675396287..9c3bbe2c3e6f 100644 --- a/drivers/gpu/drm/drm_connector.c +++ b/drivers/gpu/drm/drm_connector.c @@ -525,10 +525,6 @@ int drm_connector_register(struct drm_connector *connector) goto err_debugfs; } - ret = drm_sysfs_connector_add_late(connector); - if (ret) - goto err_late_register; - drm_mode_object_register(connector->dev, &connector->base); connector->registration_state = DRM_CONNECTOR_REGISTERED; @@ -538,9 +534,6 @@ int drm_connector_register(struct drm_connector *connector) goto unlock; -err_late_register: - if (connector->funcs->early_unregister) - connector->funcs->early_unregister(connector); err_debugfs: drm_debugfs_connector_remove(connector); drm_sysfs_connector_remove(connector); @@ -567,8 +560,6 @@ void drm_connector_unregister(struct drm_connector *connector) return; } - drm_sysfs_connector_remove_early(connector); - if (connector->funcs->early_unregister) connector->funcs->early_unregister(connector); diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h index fbad756446a2..41efe40bc70f 100644 --- a/drivers/gpu/drm/drm_internal.h +++ b/drivers/gpu/drm/drm_internal.h @@ -165,8 +165,6 @@ int drm_sysfs_init(void); void drm_sysfs_destroy(void); struct device *drm_sysfs_minor_alloc(struct drm_minor *minor); int drm_sysfs_connector_add(struct drm_connector *connector); -int drm_sysfs_connector_add_late(struct drm_connector *connector); -void drm_sysfs_connector_remove_early(struct drm_connector *connector); void drm_sysfs_connector_remove(struct drm_connector *connector); void drm_sysfs_lease_event(struct drm_device *dev); diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c index ef4eb87fa599..d3f0d048594e 100644 --- a/drivers/gpu/drm/drm_probe_helper.c +++ b/drivers/gpu/drm/drm_probe_helper.c @@ -875,32 +875,3 @@ bool drm_helper_hpd_irq_event(struct drm_device *dev) return changed; } EXPORT_SYMBOL(drm_helper_hpd_irq_event); - -/** - * drm_connector_helper_detect_from_ddc - Read EDID and detect connector status. - * @connector: The connector - * @ctx: Acquire context - * @force: Perform screen-destructive operations, if necessary - * - * Detects the connector status by reading the EDID using drm_probe_ddc(), - * which requires connector->ddc to be set. Returns connector_status_connected - * on success or connector_status_disconnected on failure. - * - * Returns: - * The connector status as defined by enum drm_connector_status. - */ -int drm_connector_helper_detect_from_ddc(struct drm_connector *connector, - struct drm_modeset_acquire_ctx *ctx, - bool force) -{ - struct i2c_adapter *ddc = connector->ddc; - - if (!ddc) - return connector_status_unknown; - - if (drm_probe_ddc(ddc)) - return connector_status_connected; - - return connector_status_disconnected; -} -EXPORT_SYMBOL(drm_connector_helper_detect_from_ddc); diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c index 5f65981bdaf4..f0336c804639 100644 --- a/drivers/gpu/drm/drm_sysfs.c +++ b/drivers/gpu/drm/drm_sysfs.c @@ -291,29 +291,20 @@ int drm_sysfs_connector_add(struct drm_connector *connector) return PTR_ERR(connector->kdev); } - return 0; -} - -int drm_sysfs_connector_add_late(struct drm_connector *connector) -{ if (connector->ddc) return sysfs_create_link(&connector->kdev->kobj, - &connector->ddc->dev.kobj, "ddc"); - + &connector->ddc->dev.kobj, "ddc"); return 0; } -void drm_sysfs_connector_remove_early(struct drm_connector *connector) -{ - if (connector->ddc) - sysfs_remove_link(&connector->kdev->kobj, "ddc"); -} - void drm_sysfs_connector_remove(struct drm_connector *connector) { if (!connector->kdev) return; + if (connector->ddc) + sysfs_remove_link(&connector->kdev->kobj, "ddc"); + DRM_DEBUG("removing \"%s\" from sysfs\n", connector->name); diff --git a/drivers/gpu/drm/hisilicon/hibmc/Kconfig b/drivers/gpu/drm/hisilicon/hibmc/Kconfig index 44c83c80aa68..4e41c144a290 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/Kconfig +++ b/drivers/gpu/drm/hisilicon/hibmc/Kconfig @@ -3,8 +3,6 @@ config DRM_HISI_HIBMC tristate "DRM Support for Hisilicon Hibmc" depends on DRM && PCI && (ARM64 || COMPILE_TEST) depends on MMU - select DRM_DISPLAY_HELPER - select DRM_DISPLAY_DP_HELPER select DRM_KMS_HELPER select DRM_VRAM_HELPER select DRM_TTM diff --git a/drivers/gpu/drm/hisilicon/hibmc/Makefile b/drivers/gpu/drm/hisilicon/hibmc/Makefile index 43fe471caee3..684ef794eb7c 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/Makefile +++ b/drivers/gpu/drm/hisilicon/hibmc/Makefile @@ -1,6 +1,4 @@ # SPDX-License-Identifier: GPL-2.0-only -hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_vdac.o hibmc_ttm.o hibmc_drm_i2c.o \ - dp/dp_aux.o dp/dp_link.o dp/dp_hw.o dp/dp_serdes.o hibmc_drm_dp.o \ - hibmc_drm_debugfs.o +hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_vdac.o hibmc_ttm.o hibmc_drm_i2c.o obj-$(CONFIG_DRM_HISI_HIBMC) += hibmc-drm.o diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c deleted file mode 100644 index 533611a211ad..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c +++ /dev/null @@ -1,167 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/io.h> -#include <linux/iopoll.h> -#include <linux/minmax.h> -#include <drm/drm_device.h> -#include <drm/drm_print.h> -#include "dp_comm.h" -#include "dp_reg.h" -#include "dp_hw.h" - -#define HIBMC_AUX_CMD_REQ_LEN GENMASK(7, 4) -#define HIBMC_AUX_CMD_ADDR GENMASK(27, 8) -#define HIBMC_AUX_CMD_I2C_ADDR_ONLY BIT(28) -#define HIBMC_BYTES_IN_U32 4 -#define HIBMC_AUX_I2C_WRITE_SUCCESS 0x1 -#define HIBMC_DP_MIN_PULSE_NUM 0x9 -#define BITS_IN_U8 8 - -static inline void hibmc_dp_aux_reset(struct hibmc_dp_dev *dp) -{ - hibmc_dp_reg_write_field(dp, HIBMC_DP_DPTX_RST_CTRL, HIBMC_DP_CFG_AUX_RST_N, 0x0); - usleep_range(10, 15); - hibmc_dp_reg_write_field(dp, HIBMC_DP_DPTX_RST_CTRL, HIBMC_DP_CFG_AUX_RST_N, 0x1); -} - -static void hibmc_dp_aux_read_data(struct hibmc_dp_dev *dp, u8 *buf, u8 size) -{ - u32 reg_num; - u32 value; - u32 num; - u8 i, j; - - reg_num = DIV_ROUND_UP(size, HIBMC_BYTES_IN_U32); - for (i = 0; i < reg_num; i++) { - /* number of bytes read from a single register */ - num = min(size - i * HIBMC_BYTES_IN_U32, HIBMC_BYTES_IN_U32); - value = readl(dp->base + HIBMC_DP_AUX_RD_DATA0 + i * HIBMC_BYTES_IN_U32); - /* convert the 32-bit value of the register to the buffer. */ - for (j = 0; j < num; j++) - buf[i * HIBMC_BYTES_IN_U32 + j] = value >> (j * BITS_IN_U8); - } -} - -static void hibmc_dp_aux_write_data(struct hibmc_dp_dev *dp, u8 *buf, u8 size) -{ - u32 reg_num; - u32 value; - u32 num; - u8 i, j; - - reg_num = DIV_ROUND_UP(size, HIBMC_BYTES_IN_U32); - for (i = 0; i < reg_num; i++) { - /* number of bytes written to a single register */ - num = min_t(u8, size - i * HIBMC_BYTES_IN_U32, HIBMC_BYTES_IN_U32); - value = 0; - /* obtain the 32-bit value written to a single register. */ - for (j = 0; j < num; j++) - value |= buf[i * HIBMC_BYTES_IN_U32 + j] << (j * BITS_IN_U8); - /* writing data to a single register */ - writel(value, dp->base + HIBMC_DP_AUX_WR_DATA0 + i * HIBMC_BYTES_IN_U32); - } -} - -static u32 hibmc_dp_aux_build_cmd(const struct drm_dp_aux_msg *msg) -{ - u32 aux_cmd = msg->request; - - if (msg->size) - aux_cmd |= FIELD_PREP(HIBMC_AUX_CMD_REQ_LEN, (msg->size - 1)); - else - aux_cmd |= FIELD_PREP(HIBMC_AUX_CMD_I2C_ADDR_ONLY, 1); - - aux_cmd |= FIELD_PREP(HIBMC_AUX_CMD_ADDR, msg->address); - - return aux_cmd; -} - -/* ret >= 0, ret is size; ret < 0, ret is err code */ -static int hibmc_dp_aux_parse_xfer(struct hibmc_dp_dev *dp, struct drm_dp_aux_msg *msg) -{ - u32 buf_data_cnt; - u32 aux_status; - - aux_status = readl(dp->base + HIBMC_DP_AUX_STATUS); - msg->reply = FIELD_GET(HIBMC_DP_CFG_AUX_STATUS, aux_status); - - if (aux_status & HIBMC_DP_CFG_AUX_TIMEOUT) - return -ETIMEDOUT; - - /* only address */ - if (!msg->size) - return 0; - - if (msg->reply != DP_AUX_NATIVE_REPLY_ACK) - return -EIO; - - buf_data_cnt = FIELD_GET(HIBMC_DP_CFG_AUX_READY_DATA_BYTE, aux_status); - - switch (msg->request) { - case DP_AUX_NATIVE_WRITE: - return msg->size; - case DP_AUX_I2C_WRITE | DP_AUX_I2C_MOT: - if (buf_data_cnt == HIBMC_AUX_I2C_WRITE_SUCCESS) - return msg->size; - else - return FIELD_GET(HIBMC_DP_CFG_AUX, aux_status); - case DP_AUX_NATIVE_READ: - case DP_AUX_I2C_READ | DP_AUX_I2C_MOT: - buf_data_cnt--; - if (buf_data_cnt != msg->size) { - /* only the successful part of data is read */ - return -EBUSY; - } - - /* all data is successfully read */ - hibmc_dp_aux_read_data(dp, msg->buffer, msg->size); - return msg->size; - default: - return -EINVAL; - } -} - -/* ret >= 0 ,ret is size; ret < 0, ret is err code */ -static ssize_t hibmc_dp_aux_xfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) -{ - struct hibmc_dp *dp_priv = container_of(aux, struct hibmc_dp, aux); - struct hibmc_dp_dev *dp = dp_priv->dp_dev; - u32 aux_cmd; - int ret; - u32 val; /* val will be assigned at the beginning of readl_poll_timeout function */ - - writel(0, dp->base + HIBMC_DP_AUX_WR_DATA0); - writel(0, dp->base + HIBMC_DP_AUX_WR_DATA1); - writel(0, dp->base + HIBMC_DP_AUX_WR_DATA2); - writel(0, dp->base + HIBMC_DP_AUX_WR_DATA3); - - hibmc_dp_aux_write_data(dp, msg->buffer, msg->size); - - aux_cmd = hibmc_dp_aux_build_cmd(msg); - writel(aux_cmd, dp->base + HIBMC_DP_AUX_CMD_ADDR); - - /* enable aux transfer */ - hibmc_dp_reg_write_field(dp, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_REQ, 0x1); - ret = readl_poll_timeout(dp->base + HIBMC_DP_AUX_REQ, val, - !(val & HIBMC_DP_CFG_AUX_REQ), 50, 5000); - if (ret) { - hibmc_dp_aux_reset(dp); - return ret; - } - - return hibmc_dp_aux_parse_xfer(dp, msg); -} - -void hibmc_dp_aux_init(struct hibmc_dp *dp) -{ - hibmc_dp_reg_write_field(dp->dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_SYNC_LEN_SEL, 0x0); - hibmc_dp_reg_write_field(dp->dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_TIMER_TIMEOUT, 0x1); - hibmc_dp_reg_write_field(dp->dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_MIN_PULSE_NUM, - HIBMC_DP_MIN_PULSE_NUM); - - dp->aux.transfer = hibmc_dp_aux_xfer; - dp->aux.name = "HIBMC DRM dp aux"; - drm_dp_aux_init(&dp->aux); - dp->dp_dev->aux = &dp->aux; -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h deleted file mode 100644 index 1107e10b2047..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h +++ /dev/null @@ -1,73 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* Copyright (c) 2024 Hisilicon Limited. */ - -#ifndef DP_COMM_H -#define DP_COMM_H - -#include <linux/types.h> -#include <linux/bitops.h> -#include <linux/errno.h> -#include <linux/mutex.h> -#include <linux/kernel.h> -#include <linux/bitfield.h> -#include <linux/io.h> -#include <drm/drm_dp_helper.h> - -#include "dp_hw.h" - -#define HIBMC_DP_LINK_RATE_CAL 27 -#define HIBMC_DP_LANE_NUM_MAX 2 - -struct hibmc_link_status { - bool clock_recovered; - bool channel_equalized; -}; - -struct hibmc_link_cap { - u8 link_rate; - u8 lanes; - int rx_dpcd_revision; - bool is_tps3; - bool is_tps4; -}; - -struct hibmc_dp_link { - struct hibmc_link_status status; - u8 train_set[HIBMC_DP_LANE_NUM_MAX]; - struct hibmc_link_cap cap; -}; - -struct hibmc_dp_dev { - struct drm_dp_aux *aux; - struct drm_device *dev; - void __iomem *base; - struct mutex lock; /* protects concurrent RW in hibmc_dp_reg_write_field() */ - struct hibmc_dp_link link; - u8 dpcd[DP_RECEIVER_CAP_SIZE]; - void __iomem *serdes_base; -}; - -#define dp_field_modify(reg_value, mask, val) \ - do { \ - (reg_value) &= ~(mask); \ - (reg_value) |= FIELD_PREP(mask, val); \ - } while (0) \ - -#define hibmc_dp_reg_write_field(dp, offset, mask, val) \ - do { \ - u32 reg_value; \ - typeof(dp) _dp = dp; \ - typeof(_dp->base) addr = (_dp->base + (offset)); \ - mutex_lock(&_dp->lock); \ - reg_value = readl(addr); \ - dp_field_modify(reg_value, mask, val); \ - writel(reg_value, addr); \ - mutex_unlock(&_dp->lock); \ - } while (0) - -void hibmc_dp_aux_init(struct hibmc_dp *dp); -int hibmc_dp_link_training(struct hibmc_dp_dev *dp); -int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp); -int hibmc_dp_serdes_set_tx_cfg(struct hibmc_dp_dev *dp, u8 train_set[HIBMC_DP_LANE_NUM_MAX]); - -#endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h deleted file mode 100644 index 08f9e1caf7fc..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h +++ /dev/null @@ -1,21 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* Copyright (c) 2024 Hisilicon Limited. */ - -#ifndef DP_CONFIG_H -#define DP_CONFIG_H - -#define HIBMC_DP_BPP 24 -#define HIBMC_DP_SYMBOL_PER_FCLK 4 -#define HIBMC_DP_MSA1 0x20 -#define HIBMC_DP_MSA2 0x845c00 -#define HIBMC_DP_OFFSET 0x1e0000 -#define HIBMC_DP_HDCP 0x2 -#define HIBMC_DP_INT_RST 0xffff -#define HIBMC_DP_DPTX_RST 0x3ff -#define HIBMC_DP_CLK_EN 0x7 -#define HIBMC_DP_SYNC_EN_MASK 0x3 -#define HIBMC_DP_LINK_RATE_CAL 27 -#define HIBMC_DP_SYNC_DELAY(lanes) ((lanes) == 0x2 ? 86 : 46) -#define HIBMC_DP_INT_ENABLE 0xc - -#endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c deleted file mode 100644 index 9e8f95d957f2..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +++ /dev/null @@ -1,338 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/io.h> -#include <linux/delay.h> -#include "dp_config.h" -#include "dp_comm.h" -#include "dp_reg.h" -#include "dp_hw.h" - -static void hibmc_dp_set_tu(struct hibmc_dp_dev *dp, struct drm_display_mode *mode) -{ - u32 tu_symbol_frac_size; - u32 tu_symbol_size; - u32 rate_ks; - u8 lane_num; - u32 value; - u32 bpp; - - lane_num = dp->link.cap.lanes; - if (lane_num == 0) { - drm_err(dp->dev, "set tu failed, lane num cannot be 0!\n"); - return; - } - - bpp = HIBMC_DP_BPP; - rate_ks = dp->link.cap.link_rate * HIBMC_DP_LINK_RATE_CAL; - value = (mode->clock * bpp * 5) / (61 * lane_num * rate_ks); - - if (value % 10 == 9) { /* 9 carry */ - tu_symbol_size = value / 10 + 1; - tu_symbol_frac_size = 0; - } else { - tu_symbol_size = value / 10; - tu_symbol_frac_size = value % 10 + 1; - } - - drm_dbg_dp(dp->dev, "tu value: %u.%u value: %u\n", - tu_symbol_size, tu_symbol_frac_size, value); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_PACKET, - HIBMC_DP_CFG_STREAM_TU_SYMBOL_SIZE, tu_symbol_size); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_PACKET, - HIBMC_DP_CFG_STREAM_TU_SYMBOL_FRAC_SIZE, tu_symbol_frac_size); -} - -static void hibmc_dp_set_sst(struct hibmc_dp_dev *dp, struct drm_display_mode *mode) -{ - u32 hblank_size; - u32 htotal_size; - u32 htotal_int; - u32 hblank_int; - u32 fclk; /* flink_clock */ - - fclk = dp->link.cap.link_rate * HIBMC_DP_LINK_RATE_CAL; - - /* Considering the effect of spread spectrum, the value may be deviated. - * The coefficient (0.9947) is used to offset the deviation. - */ - htotal_int = mode->htotal * 9947 / 10000; - htotal_size = htotal_int * fclk / (HIBMC_DP_SYMBOL_PER_FCLK * (mode->clock / 1000)); - - hblank_int = mode->htotal - mode->hdisplay - mode->hdisplay * 53 / 10000; - hblank_size = hblank_int * fclk * 9947 / - (mode->clock * 10 * HIBMC_DP_SYMBOL_PER_FCLK); - - drm_dbg_dp(dp->dev, "h_active %u v_active %u htotal_size %u hblank_size %u", - mode->hdisplay, mode->vdisplay, htotal_size, hblank_size); - drm_dbg_dp(dp->dev, "flink_clock %u pixel_clock %d", fclk, mode->clock / 1000); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_HORIZONTAL_SIZE, - HIBMC_DP_CFG_STREAM_HTOTAL_SIZE, htotal_size); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_HORIZONTAL_SIZE, - HIBMC_DP_CFG_STREAM_HBLANK_SIZE, hblank_size); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_PACKET, - HIBMC_DP_CFG_STREAM_SYNC_CALIBRATION, - HIBMC_DP_SYNC_DELAY(dp->link.cap.lanes)); -} - -static void hibmc_dp_link_cfg(struct hibmc_dp_dev *dp, struct drm_display_mode *mode) -{ - u32 timing_delay; - u32 vblank; - u32 hstart; - u32 vstart; - - vblank = mode->vtotal - mode->vdisplay; - timing_delay = mode->htotal - mode->hsync_start; - hstart = mode->htotal - mode->hsync_start; - vstart = mode->vtotal - mode->vsync_start; - - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG0, - HIBMC_DP_CFG_TIMING_GEN0_HBLANK, mode->htotal - mode->hdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG0, - HIBMC_DP_CFG_TIMING_GEN0_HACTIVE, mode->hdisplay); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG2, - HIBMC_DP_CFG_TIMING_GEN0_VBLANK, vblank); - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG2, - HIBMC_DP_CFG_TIMING_GEN0_VACTIVE, mode->vdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG3, - HIBMC_DP_CFG_TIMING_GEN0_VFRONT_PORCH, - mode->vsync_start - mode->vdisplay); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG0, - HIBMC_DP_CFG_STREAM_HACTIVE, mode->hdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG0, - HIBMC_DP_CFG_STREAM_HBLANK, mode->htotal - mode->hdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG2, - HIBMC_DP_CFG_STREAM_HSYNC_WIDTH, - mode->hsync_end - mode->hsync_start); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG1, - HIBMC_DP_CFG_STREAM_VACTIVE, mode->vdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG1, - HIBMC_DP_CFG_STREAM_VBLANK, vblank); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG3, - HIBMC_DP_CFG_STREAM_VFRONT_PORCH, - mode->vsync_start - mode->vdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG3, - HIBMC_DP_CFG_STREAM_VSYNC_WIDTH, - mode->vsync_end - mode->vsync_start); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_MSA0, - HIBMC_DP_CFG_STREAM_VSTART, vstart); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_MSA0, - HIBMC_DP_CFG_STREAM_HSTART, hstart); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_VSYNC_POLARITY, - mode->flags & DRM_MODE_FLAG_PVSYNC ? 1 : 0); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_HSYNC_POLARITY, - mode->flags & DRM_MODE_FLAG_PHSYNC ? 1 : 0); - - /* MSA mic 0 and 1 */ - writel(HIBMC_DP_MSA1, dp->base + HIBMC_DP_VIDEO_MSA1); - writel(HIBMC_DP_MSA2, dp->base + HIBMC_DP_VIDEO_MSA2); - - hibmc_dp_set_tu(dp, mode); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_RGB_ENABLE, 0x1); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_VIDEO_MAPPING, 0); - - /* divide 2: up even */ - if (timing_delay % 2) - timing_delay++; - - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_MODEL_CTRL, - HIBMC_DP_CFG_PIXEL_NUM_TIMING_MODE_SEL1, timing_delay); - - hibmc_dp_set_sst(dp, mode); -} - -int hibmc_dp_hw_init(struct hibmc_dp *dp) -{ - struct drm_device *drm_dev = dp->drm_dev; - struct hibmc_dp_dev *dp_dev; - - dp_dev = devm_kzalloc(drm_dev->dev, sizeof(struct hibmc_dp_dev), GFP_KERNEL); - if (!dp_dev) - return -ENOMEM; - - mutex_init(&dp_dev->lock); - - dp->dp_dev = dp_dev; - - dp_dev->dev = drm_dev; - dp_dev->base = dp->mmio + HIBMC_DP_OFFSET; - dp_dev->serdes_base = dp_dev->base + HIBMC_DP_HOST_OFFSET; - - hibmc_dp_aux_init(dp); - - dp_dev->link.cap.lanes = 0x2; - dp_dev->link.cap.link_rate = DP_LINK_BW_8_1; - - /* int init */ - writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); - writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); - /* rst */ - writel(0, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - usleep_range(30, 50); - writel(HIBMC_DP_DPTX_RST, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - /* hdcp data */ - writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); - /* clock enable */ - writel(HIBMC_DP_CLK_EN, dp_dev->base + HIBMC_DP_DPTX_CLK_CTRL); - - return 0; -} - -void hibmc_dp_enable_int(struct hibmc_dp *dp) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - - writel(HIBMC_DP_INT_ENABLE, dp_dev->base + HIBMC_DP_INTR_ENABLE); -} - -void hibmc_dp_disable_int(struct hibmc_dp *dp) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - - writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); - writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); -} - -void hibmc_dp_hpd_cfg(struct hibmc_dp *dp) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_SYNC_LEN_SEL, 0x0); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_TIMER_TIMEOUT, 0x1); - hibmc_dp_reg_write_field(dp->dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_MIN_PULSE_NUM, 0x9); - writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); - writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); - writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); - writel(HIBMC_DP_INT_ENABLE, dp_dev->base + HIBMC_DP_INTR_ENABLE); - writel(HIBMC_DP_DPTX_RST, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - writel(HIBMC_DP_CLK_EN, dp_dev->base + HIBMC_DP_DPTX_CLK_CTRL); -} - -void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - - if (enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, - HIBMC_DP_CFG_MST_ENABLE, 0x1); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0x1); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - } else { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_MST_ENABLE, 0); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - } - - msleep(50); -} - -int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - int ret; - - if (!dp_dev->link.status.channel_equalized) { - ret = hibmc_dp_link_training(dp_dev); - if (ret) { - drm_err(dp->drm_dev, "dp link training failed, ret: %d\n", ret); - return ret; - } - } - - hibmc_dp_display_en(dp, false); - hibmc_dp_link_cfg(dp_dev, mode); - - return 0; -} - -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.link_rate; -} - -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.lanes; -} - -int hibmc_dp_get_dpcd(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.rx_dpcd_revision; -} - -void hibmc_dp_reset_link(struct hibmc_dp *dp) -{ - if (dp->dp_dev) { - dp->dp_dev->link.status.clock_recovered = false; - dp->dp_dev->link.status.channel_equalized = false; - } -} - -static const struct hibmc_dp_color_raw g_rgb_raw[] = { - {CBAR_COLOR_BAR, 0x000, 0x000, 0x000}, - {CBAR_WHITE, 0xfff, 0xfff, 0xfff}, - {CBAR_RED, 0xfff, 0x000, 0x000}, - {CBAR_ORANGE, 0xfff, 0x800, 0x000}, - {CBAR_YELLOW, 0xfff, 0xfff, 0x000}, - {CBAR_GREEN, 0x000, 0xfff, 0x000}, - {CBAR_CYAN, 0x000, 0x800, 0x800}, - {CBAR_BLUE, 0x000, 0x000, 0xfff}, - {CBAR_PURPLE, 0x800, 0x000, 0x800}, - {CBAR_BLACK, 0x000, 0x000, 0x000}, -}; - -void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - struct hibmc_dp_color_raw raw_data; - - if (cfg->enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_TIMING_SEL_M, cfg->self_timing); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_CTRL_M, cfg->dynamic_rate); - if (cfg->pattern == CBAR_COLOR_BAR) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 0); - } else { - raw_data = g_rgb_raw[cfg->pattern]; - drm_dbg_dp(dp->drm_dev, "r:%x g:%x b:%x\n", raw_data.r_value, - raw_data.g_value, raw_data.b_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 1); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_DATA_R_M, raw_data.r_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_G_M, raw_data.g_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_B_M, raw_data.b_value); - } - } - - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_ENABLE_M, cfg->enable); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); -} - diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h deleted file mode 100644 index 4740db06e1b0..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h +++ /dev/null @@ -1,74 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* Copyright (c) 2024 Hisilicon Limited. */ - -#ifndef DP_KAPI_H -#define DP_KAPI_H - -#include <linux/types.h> -#include <linux/delay.h> -#include <drm/drm_device.h> -#include <drm/drm_encoder.h> -#include <drm/drm_connector.h> -#include <drm/drm_print.h> -#include <drm/drm_dp_helper.h> - -// 27 * 10000000 * 80% = 216000000 -#define DP_MODE_VALI_CAL 216000000 -#define BPP_24 24 - -struct hibmc_dp_dev; - -enum hibmc_dp_cbar_pattern { - CBAR_COLOR_BAR, - CBAR_WHITE, - CBAR_RED, - CBAR_ORANGE, - CBAR_YELLOW, - CBAR_GREEN, - CBAR_CYAN, - CBAR_BLUE, - CBAR_PURPLE, - CBAR_BLACK, -}; - -struct hibmc_dp_color_raw { - enum hibmc_dp_cbar_pattern pattern; - u32 r_value; - u32 g_value; - u32 b_value; -}; - -struct hibmc_dp_cbar_cfg { - u8 enable; - u8 self_timing; - u8 dynamic_rate; /* 0:static, 1-255(frame):dynamic */ - enum hibmc_dp_cbar_pattern pattern; -}; - -struct hibmc_dp { - struct hibmc_dp_dev *dp_dev; - struct drm_device *drm_dev; - struct drm_encoder encoder; - struct drm_connector connector; - void __iomem *mmio; - struct drm_dp_aux aux; - struct hibmc_dp_cbar_cfg cfg; - u32 irq_status; - int hpd_status; - bool is_connected; -}; - -int hibmc_dp_hw_init(struct hibmc_dp *dp); -int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode); -void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable); -struct edid *hibmc_dp_get_edid(struct hibmc_dp *dp); -int hibmc_dp_get_dpcd(struct hibmc_dp *dp); -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp); -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp); -void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg); -void hibmc_dp_reset_link(struct hibmc_dp *dp); -void hibmc_dp_hpd_cfg(struct hibmc_dp *dp); -void hibmc_dp_enable_int(struct hibmc_dp *dp); -void hibmc_dp_disable_int(struct hibmc_dp *dp); - -#endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c deleted file mode 100644 index 9b632428fec6..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c +++ /dev/null @@ -1,415 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/delay.h> -#include <drm/drm_device.h> -#include <drm/drm_print.h> -#include "dp_comm.h" -#include "dp_reg.h" - -#define HIBMC_EQ_MAX_RETRY 5 - -static inline int hibmc_dp_get_serdes_rate_cfg(struct hibmc_dp_dev *dp) -{ - switch (dp->link.cap.link_rate) { - case DP_LINK_BW_1_62: - return DP_SERDES_BW_1_62; - case DP_LINK_BW_2_7: - return DP_SERDES_BW_2_7; - case DP_LINK_BW_5_4: - return DP_SERDES_BW_5_4; - case DP_LINK_BW_8_1: - return DP_SERDES_BW_8_1; - default: - return -EINVAL; - } -} - -static int hibmc_dp_link_training_configure(struct hibmc_dp_dev *dp) -{ - u8 buf[2]; - int ret; - - /* DP 2 lane */ - hibmc_dp_reg_write_field(dp, HIBMC_DP_PHYIF_CTRL0, HIBMC_DP_CFG_LANE_DATA_EN, - dp->link.cap.lanes == 0x2 ? 0x3 : 0x1); - hibmc_dp_reg_write_field(dp, HIBMC_DP_DPTX_GCTL0, HIBMC_DP_CFG_PHY_LANE_NUM, - dp->link.cap.lanes == 0x2 ? 0x1 : 0); - - /* enhanced frame */ - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_FRAME_MODE, 0x1); - - ret = hibmc_dp_get_serdes_rate_cfg(dp); - if (ret < 0) - return ret; - - ret = hibmc_dp_serdes_rate_switch(ret, dp); - if (ret) - return ret; - - /* set rate and lane count */ - buf[0] = dp->link.cap.link_rate; - buf[1] = DP_LANE_COUNT_ENHANCED_FRAME_EN | dp->link.cap.lanes; - ret = drm_dp_dpcd_write(dp->aux, DP_LINK_BW_SET, buf, sizeof(buf)); - if (ret != sizeof(buf)) { - drm_dbg_dp(dp->dev, "dp aux write link rate and lanes failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; - } - - /* set 8b/10b and downspread */ - buf[0] = DP_SPREAD_AMP_0_5; - buf[1] = DP_SET_ANSI_8B10B; - ret = drm_dp_dpcd_write(dp->aux, DP_DOWNSPREAD_CTRL, buf, sizeof(buf)); - if (ret != sizeof(buf)) { - drm_dbg_dp(dp->dev, "dp aux write 8b/10b and downspread failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; - } - - return 0; -} - -static int hibmc_dp_link_set_pattern(struct hibmc_dp_dev *dp, int pattern) -{ - int ret; - u8 val; - u8 buf; - - buf = (u8)pattern; - if (pattern != DP_TRAINING_PATTERN_DISABLE && pattern != DP_TRAINING_PATTERN_4) { - buf |= DP_LINK_SCRAMBLING_DISABLE; - hibmc_dp_reg_write_field(dp, HIBMC_DP_PHYIF_CTRL0, HIBMC_DP_CFG_SCRAMBLE_EN, 0x1); - } else { - hibmc_dp_reg_write_field(dp, HIBMC_DP_PHYIF_CTRL0, HIBMC_DP_CFG_SCRAMBLE_EN, 0); - } - - switch (pattern) { - case DP_TRAINING_PATTERN_DISABLE: - val = 0; - break; - case DP_TRAINING_PATTERN_1: - val = 1; - break; - case DP_TRAINING_PATTERN_2: - val = 2; - break; - case DP_TRAINING_PATTERN_3: - val = 3; - break; - case DP_TRAINING_PATTERN_4: - val = 4; - break; - default: - return -EINVAL; - } - - hibmc_dp_reg_write_field(dp, HIBMC_DP_PHYIF_CTRL0, HIBMC_DP_CFG_PAT_SEL, val); - - ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_PATTERN_SET, &buf, sizeof(buf)); - if (ret != sizeof(buf)) { - drm_dbg_dp(dp->dev, "dp aux write training pattern set failed\n"); - return ret >= 0 ? -EIO : ret; - } - - return 0; -} - -static int hibmc_dp_link_training_cr_pre(struct hibmc_dp_dev *dp) -{ - u8 *train_set = dp->link.train_set; - int ret; - u8 i; - - ret = hibmc_dp_link_training_configure(dp); - if (ret) - return ret; - - ret = hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_1); - if (ret) - return ret; - - for (i = 0; i < dp->link.cap.lanes; i++) - train_set[i] = DP_TRAIN_VOLTAGE_SWING_LEVEL_0; - - ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); - if (ret) - return ret; - - ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, train_set, dp->link.cap.lanes); - if (ret != dp->link.cap.lanes) { - drm_dbg_dp(dp->dev, "dp aux write training lane set failed\n"); - return ret >= 0 ? -EIO : ret; - } - - return 0; -} - -static bool hibmc_dp_link_get_adjust_train(struct hibmc_dp_dev *dp, - u8 lane_status[DP_LINK_STATUS_SIZE]) -{ - u8 train_set[HIBMC_DP_LANE_NUM_MAX] = {0}; - u8 lane; - - for (lane = 0; lane < dp->link.cap.lanes; lane++) - train_set[lane] = drm_dp_get_adjust_request_voltage(lane_status, lane) | - drm_dp_get_adjust_request_pre_emphasis(lane_status, lane); - - if (memcmp(dp->link.train_set, train_set, HIBMC_DP_LANE_NUM_MAX)) { - memcpy(dp->link.train_set, train_set, HIBMC_DP_LANE_NUM_MAX); - return true; - } - - return false; -} - -static int hibmc_dp_link_reduce_rate(struct hibmc_dp_dev *dp) -{ - int ret; - - switch (dp->link.cap.link_rate) { - case DP_LINK_BW_2_7: - dp->link.cap.link_rate = DP_LINK_BW_1_62; - break; - case DP_LINK_BW_5_4: - dp->link.cap.link_rate = DP_LINK_BW_2_7; - break; - case DP_LINK_BW_8_1: - dp->link.cap.link_rate = DP_LINK_BW_5_4; - break; - default: - return -EINVAL; - } - - ret = hibmc_dp_get_serdes_rate_cfg(dp); - if (ret < 0) - return ret; - - return hibmc_dp_serdes_rate_switch(ret, dp); -} - -static inline int hibmc_dp_link_reduce_lane(struct hibmc_dp_dev *dp) -{ - switch (dp->link.cap.lanes) { - case 0x2: - dp->link.cap.lanes--; - drm_dbg_dp(dp->dev, "dp link training reduce to 1 lane\n"); - break; - case 0x1: - drm_err(dp->dev, "dp link training reduce lane failed, already reach minimum\n"); - return -EIO; - default: - return -EINVAL; - } - - return 0; -} - -static int hibmc_dp_link_training_cr(struct hibmc_dp_dev *dp) -{ - u8 lane_status[DP_LINK_STATUS_SIZE] = {0}; - bool level_changed; - u32 voltage_tries; - u32 cr_tries; - u32 max_cr; - int ret; - - /* - * DP 1.4 spec define 10 for maxtries value, for pre DP 1.4 version set a limit of 80 - * (4 voltage levels x 4 preemphasis levels x 5 identical voltage retries) - */ - max_cr = dp->link.cap.rx_dpcd_revision >= DP_DPCD_REV_14 ? 10 : 80; - - voltage_tries = 1; - for (cr_tries = 0; cr_tries < max_cr; cr_tries++) { - drm_dp_link_train_clock_recovery_delay(dp->dpcd); - - ret = drm_dp_dpcd_read_link_status(dp->aux, lane_status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "Get lane status failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; - } - - if (drm_dp_clock_recovery_ok(lane_status, dp->link.cap.lanes)) { - drm_dbg_dp(dp->dev, "dp link training cr done\n"); - dp->link.status.clock_recovered = true; - return 0; - } - - if (voltage_tries == 5) { - drm_dbg_dp(dp->dev, "same voltage tries 5 times\n"); - dp->link.status.clock_recovered = false; - return 0; - } - - level_changed = hibmc_dp_link_get_adjust_train(dp, lane_status); - - ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); - if (ret) - return ret; - - ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, dp->link.train_set, - dp->link.cap.lanes); - if (ret != dp->link.cap.lanes) { - drm_dbg_dp(dp->dev, "Update link training failed\n"); - return ret >= 0 ? -EIO : ret; - } - - voltage_tries = level_changed ? 1 : voltage_tries + 1; - } - - drm_err(dp->dev, "dp link training clock recovery %u timers failed\n", max_cr); - dp->link.status.clock_recovered = false; - - return 0; -} - -static int hibmc_dp_link_training_channel_eq(struct hibmc_dp_dev *dp) -{ - u8 lane_status[DP_LINK_STATUS_SIZE] = {0}; - u8 eq_tries; - int tps; - int ret; - - if (dp->link.cap.is_tps4) - tps = DP_TRAINING_PATTERN_4; - else if (dp->link.cap.is_tps3) - tps = DP_TRAINING_PATTERN_3; - else - tps = DP_TRAINING_PATTERN_2; - - ret = hibmc_dp_link_set_pattern(dp, tps); - if (ret) - return ret; - - for (eq_tries = 0; eq_tries < HIBMC_EQ_MAX_RETRY; eq_tries++) { - drm_dp_link_train_channel_eq_delay(dp->dpcd); - - ret = drm_dp_dpcd_read_link_status(dp->aux, lane_status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "get lane status failed\n"); - break; - } - - if (!drm_dp_clock_recovery_ok(lane_status, dp->link.cap.lanes)) { - drm_dbg_dp(dp->dev, "clock recovery check failed\n"); - drm_dbg_dp(dp->dev, "cannot continue channel equalization\n"); - dp->link.status.clock_recovered = false; - break; - } - - if (drm_dp_channel_eq_ok(lane_status, dp->link.cap.lanes)) { - dp->link.status.channel_equalized = true; - drm_dbg_dp(dp->dev, "dp link training eq done\n"); - break; - } - - hibmc_dp_link_get_adjust_train(dp, lane_status); - - ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); - if (ret) - break; - - ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, - dp->link.train_set, dp->link.cap.lanes); - if (ret != dp->link.cap.lanes) { - drm_dbg_dp(dp->dev, "Update link training failed\n"); - ret = (ret >= 0) ? -EIO : ret; - break; - } - } - - if (eq_tries == HIBMC_EQ_MAX_RETRY) - drm_err(dp->dev, "channel equalization failed %u times\n", eq_tries); - - hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_DISABLE); - - return ret < 0 ? ret : 0; -} - -static int hibmc_dp_link_downgrade_training_cr(struct hibmc_dp_dev *dp) -{ - if (hibmc_dp_link_reduce_rate(dp)) - return hibmc_dp_link_reduce_lane(dp); - - return 0; -} - -static int hibmc_dp_link_downgrade_training_eq(struct hibmc_dp_dev *dp) -{ - u8 status[DP_LINK_STATUS_SIZE] = {0}; - int ret; - - ret = drm_dp_dpcd_read_link_status(dp->aux, status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "get lane status failed\n"); - return ret >= 0 ? -EIO : ret; - } - - if ((dp->link.status.clock_recovered && !dp->link.status.channel_equalized) || - (status[0] != 0 && !dp->link.status.clock_recovered)) { // at least one cr_done - if (!hibmc_dp_link_reduce_lane(dp)) - return 0; - } - - return hibmc_dp_link_reduce_rate(dp); -} - -static void hibmc_dp_update_caps(struct hibmc_dp_dev *dp) -{ - dp->link.cap.rx_dpcd_revision = dp->dpcd[DP_DPCD_REV]; - - dp->link.cap.is_tps3 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_13) && - (dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED); - dp->link.cap.is_tps4 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_14) && - (dp->dpcd[DP_MAX_DOWNSPREAD] & DP_TPS4_SUPPORTED); - dp->link.cap.link_rate = dp->dpcd[DP_MAX_LINK_RATE]; - dp->link.cap.lanes = dp->dpcd[DP_MAX_LANE_COUNT] & DP_MAX_LANE_COUNT_MASK; - if (dp->link.cap.lanes > HIBMC_DP_LANE_NUM_MAX) - dp->link.cap.lanes = HIBMC_DP_LANE_NUM_MAX; -} - -int hibmc_dp_link_training(struct hibmc_dp_dev *dp) -{ - struct hibmc_dp_link *link = &dp->link; - int ret; - - ret = drm_dp_read_dpcd_caps(dp->aux, dp->dpcd); - if (ret) - drm_err(dp->dev, "dp aux read dpcd failed, ret: %d\n", ret); - - hibmc_dp_update_caps(dp); - - while (true) { - ret = hibmc_dp_link_training_cr_pre(dp); - if (ret) - goto err; - - ret = hibmc_dp_link_training_cr(dp); - if (ret) - goto err; - - if (!link->status.clock_recovered) { - ret = hibmc_dp_link_downgrade_training_cr(dp); - if (ret) - goto err; - continue; - } - - ret = hibmc_dp_link_training_channel_eq(dp); - if (ret) - goto err; - - if (!link->status.channel_equalized) { - ret = hibmc_dp_link_downgrade_training_eq(dp); - if (ret) - goto err; - continue; - } - - return 0; - } - -err: - hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_DISABLE); - - return ret; -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h deleted file mode 100644 index 156e5d63c47f..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h +++ /dev/null @@ -1,140 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* Copyright (c) 2024 Hisilicon Limited. */ - -#ifndef DP_REG_H -#define DP_REG_H - -#define HIBMC_DP_AUX_CMD_ADDR 0x50 - -#define HIBMC_DP_AUX_WR_DATA0 0x54 -#define HIBMC_DP_AUX_WR_DATA1 0x58 -#define HIBMC_DP_AUX_WR_DATA2 0x5c -#define HIBMC_DP_AUX_WR_DATA3 0x60 -#define HIBMC_DP_AUX_RD_DATA0 0x64 - -#define HIBMC_DP_AUX_REQ 0x74 -#define HIBMC_DP_CFG_AUX_REQ BIT(0) -#define HIBMC_DP_CFG_AUX_SYNC_LEN_SEL BIT(1) -#define HIBMC_DP_CFG_AUX_TIMER_TIMEOUT BIT(2) -#define HIBMC_DP_CFG_AUX_MIN_PULSE_NUM GENMASK(13, 9) - -#define HIBMC_DP_AUX_STATUS 0x78 -#define HIBMC_DP_CFG_AUX_TIMEOUT BIT(0) -#define HIBMC_DP_CFG_AUX_STATUS GENMASK(11, 4) -#define HIBMC_DP_CFG_AUX_READY_DATA_BYTE GENMASK(16, 12) -#define HIBMC_DP_CFG_AUX GENMASK(24, 17) - -#define HIBMC_DP_PHYIF_CTRL0 0xa0 -#define HIBMC_DP_CFG_SCRAMBLE_EN BIT(0) -#define HIBMC_DP_CFG_PAT_SEL GENMASK(7, 4) -#define HIBMC_DP_CFG_LANE_DATA_EN GENMASK(11, 8) - -#define HIBMC_DP_VIDEO_CTRL 0x100 -#define HIBMC_DP_CFG_STREAM_RGB_ENABLE BIT(1) -#define HIBMC_DP_CFG_STREAM_VIDEO_MAPPING GENMASK(5, 2) -#define HIBMC_DP_CFG_STREAM_FRAME_MODE BIT(6) -#define HIBMC_DP_CFG_STREAM_HSYNC_POLARITY BIT(7) -#define HIBMC_DP_CFG_STREAM_VSYNC_POLARITY BIT(8) - -#define HIBMC_DP_VIDEO_CONFIG0 0x104 -#define HIBMC_DP_CFG_STREAM_HACTIVE GENMASK(31, 16) -#define HIBMC_DP_CFG_STREAM_HBLANK GENMASK(15, 0) - -#define HIBMC_DP_VIDEO_CONFIG1 0x108 -#define HIBMC_DP_CFG_STREAM_VACTIVE GENMASK(31, 16) -#define HIBMC_DP_CFG_STREAM_VBLANK GENMASK(15, 0) - -#define HIBMC_DP_VIDEO_CONFIG2 0x10c -#define HIBMC_DP_CFG_STREAM_HSYNC_WIDTH GENMASK(15, 0) - -#define HIBMC_DP_VIDEO_CONFIG3 0x110 -#define HIBMC_DP_CFG_STREAM_VSYNC_WIDTH GENMASK(15, 0) -#define HIBMC_DP_CFG_STREAM_VFRONT_PORCH GENMASK(31, 16) - -#define HIBMC_DP_VIDEO_PACKET 0x114 -#define HIBMC_DP_CFG_STREAM_TU_SYMBOL_SIZE GENMASK(5, 0) -#define HIBMC_DP_CFG_STREAM_TU_SYMBOL_FRAC_SIZE GENMASK(9, 6) -#define HIBMC_DP_CFG_STREAM_SYNC_CALIBRATION GENMASK(31, 20) - -#define HIBMC_DP_VIDEO_MSA0 0x118 -#define HIBMC_DP_CFG_STREAM_VSTART GENMASK(31, 16) -#define HIBMC_DP_CFG_STREAM_HSTART GENMASK(15, 0) - -#define HIBMC_DP_VIDEO_MSA1 0x11c -#define HIBMC_DP_VIDEO_MSA2 0x120 - -#define HIBMC_DP_VIDEO_HORIZONTAL_SIZE 0X124 -#define HIBMC_DP_CFG_STREAM_HTOTAL_SIZE GENMASK(31, 16) -#define HIBMC_DP_CFG_STREAM_HBLANK_SIZE GENMASK(15, 0) - -#define HIBMC_DP_COLOR_BAR_CTRL 0x260 -#define HIBMC_DP_COLOR_BAR_ENABLE_M BIT(0) -#define HIBMC_DP_COLOR_BAR_CTRL_M GENMASK(8, 1) -#define HIBMC_DP_COLOR_BAR_TIMING_SEL_M BIT(9) -#define HIBMC_DP_COLOR_BAR_PATTERN_SEL_M BIT(10) -#define HIBMC_DP_COLOR_BAR_DATA_R_M GENMASK(23, 12) -#define HIBMC_DP_COLOR_BAR_CTRL1 0x264 -#define HIBMC_DP_COLOR_BAR_DATA_B_M GENMASK(11, 0) -#define HIBMC_DP_COLOR_BAR_DATA_G_M GENMASK(23, 12) -#define HIBMC_DP_TIMING_GEN_CONFIG0 0x26c -#define HIBMC_DP_CFG_TIMING_GEN0_HACTIVE GENMASK(31, 16) -#define HIBMC_DP_CFG_TIMING_GEN0_HBLANK GENMASK(15, 0) - -#define HIBMC_DP_TIMING_GEN_CONFIG2 0x274 -#define HIBMC_DP_CFG_TIMING_GEN0_VACTIVE GENMASK(31, 16) -#define HIBMC_DP_CFG_TIMING_GEN0_VBLANK GENMASK(15, 0) - -#define HIBMC_DP_TIMING_GEN_CONFIG3 0x278 -#define HIBMC_DP_CFG_TIMING_GEN0_VFRONT_PORCH GENMASK(31, 16) - -#define HIBMC_DP_HDCP_CFG 0x600 - -#define HIBMC_DP_DPTX_RST_CTRL 0x700 -#define HIBMC_DP_CFG_AUX_RST_N BIT(4) - -#define HIBMC_DP_DPTX_CLK_CTRL 0x704 - -#define HIBMC_DP_DPTX_GCTL0 0x708 -#define HIBMC_DP_CFG_PHY_LANE_NUM GENMASK(2, 1) -#define HIBMC_DP_CFG_TIMING_GEN_ENABLE BIT(10) -#define HIBMC_DP_CFG_MST_ENABLE BIT(0) - -#define HIBMC_DP_INTR_ENABLE 0x720 -#define HIBMC_DP_INTR_ORIGINAL_STATUS 0x728 - -#define HIBMC_DP_TIMING_MODEL_CTRL 0x884 -#define HIBMC_DP_CFG_PIXEL_NUM_TIMING_MODE_SEL1 GENMASK(31, 16) - -#define HIBMC_DP_TIMING_SYNC_CTRL 0xFF0 - -#define HIBMC_DP_INTSTAT 0x1e0724 -#define HIBMC_DP_INTCLR 0x1e0728 - -/* dp serdes reg */ -#define HIBMC_DP_HOST_OFFSET 0x10000 -#define HIBMC_DP_LANE0_RATE_OFFSET 0x4 -#define HIBMC_DP_LANE1_RATE_OFFSET 0xc -#define HIBMC_DP_LANE_STATUS_OFFSET 0x10 -#define HIBMC_DP_PMA_LANE0_OFFSET 0x18 -#define HIBMC_DP_PMA_LANE1_OFFSET 0x1c -#define HIBMC_DP_HOST_SERDES_CTRL 0x1f001c -#define HIBMC_DP_PMA_TXDEEMPH GENMASK(18, 1) -#define DP_SERDES_DONE 0x3 - -/* dp serdes TX-Deempth Configuration */ -#define DP_SERDES_VOL0_PRE0 0x280 -#define DP_SERDES_VOL0_PRE1 0x2300 -#define DP_SERDES_VOL0_PRE2 0x53c0 -#define DP_SERDES_VOL0_PRE3 0x8400 -#define DP_SERDES_VOL1_PRE0 0x380 -#define DP_SERDES_VOL1_PRE1 0x3440 -#define DP_SERDES_VOL1_PRE2 0x6480 -#define DP_SERDES_VOL2_PRE0 0x4c1 -#define DP_SERDES_VOL2_PRE1 0x4500 -#define DP_SERDES_VOL3_PRE0 0x600 -#define DP_SERDES_BW_8_1 0x3 -#define DP_SERDES_BW_5_4 0x2 -#define DP_SERDES_BW_2_7 0x1 -#define DP_SERDES_BW_1_62 0x0 - -#endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c deleted file mode 100644 index 8191233aa965..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c +++ /dev/null @@ -1,59 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2025 Hisilicon Limited. - -#include <linux/delay.h> -#include <drm/drm_device.h> -#include <drm/drm_print.h> -#include "dp_comm.h" -#include "dp_config.h" -#include "dp_reg.h" - -int hibmc_dp_serdes_set_tx_cfg(struct hibmc_dp_dev *dp, u8 train_set[HIBMC_DP_LANE_NUM_MAX]) -{ - static const u32 serdes_tx_cfg[4][4] = { {DP_SERDES_VOL0_PRE0, DP_SERDES_VOL0_PRE1, - DP_SERDES_VOL0_PRE2, DP_SERDES_VOL0_PRE3}, - {DP_SERDES_VOL1_PRE0, DP_SERDES_VOL1_PRE1, - DP_SERDES_VOL1_PRE2}, {DP_SERDES_VOL2_PRE0, - DP_SERDES_VOL2_PRE1}, {DP_SERDES_VOL3_PRE0}}; - int cfg[2]; - int i; - - for (i = 0; i < HIBMC_DP_LANE_NUM_MAX; i++) { - cfg[i] = serdes_tx_cfg[FIELD_GET(DP_TRAIN_VOLTAGE_SWING_MASK, train_set[i])] - [FIELD_GET(DP_TRAIN_PRE_EMPHASIS_MASK, train_set[i])]; - if (!cfg[i]) - return -EINVAL; - - /* lane1 offset is 4 */ - writel(FIELD_PREP(HIBMC_DP_PMA_TXDEEMPH, cfg[i]), - dp->serdes_base + HIBMC_DP_PMA_LANE0_OFFSET + i * 4); - } - - usleep_range(300, 500); - - if (readl(dp->serdes_base + HIBMC_DP_LANE_STATUS_OFFSET) != DP_SERDES_DONE) { - drm_dbg_dp(dp->dev, "dp serdes cfg failed\n"); - return -EAGAIN; - } - - return 0; -} - -int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp) -{ - writel(rate, dp->serdes_base + HIBMC_DP_LANE0_RATE_OFFSET); - writel(rate, dp->serdes_base + HIBMC_DP_LANE1_RATE_OFFSET); - - usleep_range(300, 500); - - if (readl(dp->serdes_base + HIBMC_DP_LANE_STATUS_OFFSET) != DP_SERDES_DONE) { - drm_dbg_dp(dp->dev, "dp serdes rate switching failed\n"); - return -EAGAIN; - } - - if (rate < DP_SERDES_BW_8_1) - drm_dbg_dp(dp->dev, "reducing serdes rate to :%d\n", - rate ? rate * HIBMC_DP_LINK_RATE_CAL * 10 : 162); - - return 0; -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c deleted file mode 100644 index 6c6ff3255d15..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c +++ /dev/null @@ -1,149 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/debugfs.h> -#include <linux/device.h> -#include <linux/seq_file.h> -#include <linux/pci.h> - -#include <drm/drm_drv.h> -#include <drm/drm_file.h> -#include <drm/drm_debugfs.h> -#include <drm/drm_edid.h> - -#include "hibmc_drm_drv.h" - -#define MAX_BUF_SIZE 12 - -static int hibmc_dp_show(struct seq_file *m, void *arg) -{ - struct drm_info_node *node = m->private; - struct drm_device *dev = node->minor->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - int idx, rate; - - if (!drm_dev_enter(dev, &idx)) - return -ENODEV; - - switch (hibmc_dp_get_link_rate(&priv->dp)) { - case 0x1e: - rate = 810; // 8.1Gbps - break; - case 0x14: - rate = 540; // 5.4Gbps - break; - case 0xA: - rate = 270; // 2.7Gbps - break; - case 0x6: - rate = 162; // 1.62Gbps - break; - default: - rate = 0; - } - - seq_printf(m, "enable lanes: %u\n", hibmc_dp_get_lanes(&priv->dp)); - seq_printf(m, "link rate: %d\n", rate); - seq_printf(m, "vfresh: %d\n", drm_mode_vrefresh(&priv->crtc.mode)); - seq_printf(m, "dpcd version: 0x%x\n", hibmc_dp_get_dpcd(&priv->dp)); - seq_printf(m, "hpd status: %d\n", priv->dp.hpd_status); - - drm_dev_exit(idx); - - return 0; -} - -static ssize_t hibmc_control_write(struct file *file, const char __user *user_buf, - size_t count, loff_t *ppos) -{ - struct hibmc_drm_private *priv = file_inode(file)->i_private; - struct hibmc_dp_cbar_cfg *cfg = &priv->dp.cfg; - int ret, idx; - u8 buf[MAX_BUF_SIZE]; - - if (count >= MAX_BUF_SIZE) - return -EINVAL; - - if (copy_from_user(buf, user_buf, count)) - return -EFAULT; - - buf[count] = '\0'; - - /* Only 4 parameters is allowed, the ranger are as follow: - * [0] enable/disable colorbar feature - 0: enable colorbar, 1: disable colorbar - * [1] the timing source of colorbar displaying - 0: timing follows XDP, 1: internal self timing - * [2] the movment of colorbar displaying - 0: static colorbar image, - * 1~255: right shifting a type of color per (1~255)frames - * [3] the color type of colorbar displaying - 0~9: color bar, white, red, orange, - * yellow, green, cyan, bule, pupper, black - */ - if (sscanf(buf, "%hhu %hhu %hhu %u", &cfg->enable, &cfg->self_timing, - &cfg->dynamic_rate, &cfg->pattern) != 4) { - return -EINVAL; - } - - if (cfg->pattern > 9 || cfg->enable > 1 || cfg->self_timing > 1) - return -EINVAL; - - ret = drm_dev_enter(priv->dev, &idx); - if (!ret) - return -ENODEV; - - hibmc_dp_set_cbar(&priv->dp, cfg); - - drm_dev_exit(idx); - - return count; -} - -static int hibmc_dp_dbgfs_show(struct seq_file *m, void *arg) -{ - struct hibmc_drm_private *priv = m->private; - struct hibmc_dp_cbar_cfg *cfg = &priv->dp.cfg; - int idx; - - if (!drm_dev_enter(priv->dev, &idx)) - return -ENODEV; - - seq_printf(m, "hibmc dp colorbar cfg: %u %u %u %u\n", cfg->enable, cfg->self_timing, - cfg->dynamic_rate, cfg->pattern); - - drm_dev_exit(idx); - - return 0; -} - -static int hibmc_open(struct inode *inode, struct file *filp) -{ - return single_open(filp, hibmc_dp_dbgfs_show, inode->i_private); -} - -static const struct file_operations hibmc_dbg_fops = { - .owner = THIS_MODULE, - .write = hibmc_control_write, - .read = seq_read, - .open = hibmc_open, - .llseek = seq_lseek, - .release = single_release, -}; - -static struct drm_info_list hibmc_debugfs_list[] = { - { "hibmc-dp", hibmc_dp_show }, -}; - -void hibmc_debugfs_init(struct drm_connector *connector, struct dentry *root) -{ - struct drm_device *dev = connector->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - struct drm_minor *minor = dev->primary; - - /* create the file in drm directory, so we don't need to remove manually */ - debugfs_create_file("colorbar-cfg", 0200, root, priv, &hibmc_dbg_fops); - - drm_debugfs_create_files(hibmc_debugfs_list, ARRAY_SIZE(hibmc_debugfs_list), - minor->debugfs_root, minor); -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c deleted file mode 100644 index ae6f5c235e02..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c +++ /dev/null @@ -1,257 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/io.h> - -#include <drm/drm_probe_helper.h> -#include <drm/drm_simple_kms_helper.h> -#include <drm/drm_atomic_helper.h> -#include <drm/drm_modes.h> -#include <drm/drm_drv.h> -#include <drm/drm_edid.h> - -#include "hibmc_drm_drv.h" -#include "hibmc_drm_regs.h" -#include "dp/dp_hw.h" - -#define HIBMC_DP_MASKED_SINK_HPD_PLUG_INT BIT(2) -#define HIBMC_DP_MASKED_SINK_HPD_UNPLUG_INT BIT(3) - -static int hibmc_dp_connector_get_modes(struct drm_connector *connector) -{ - int count; - struct hibmc_dp *dp = to_hibmc_dp(connector); - struct edid *edid; - - - edid = drm_get_edid(connector, &dp->aux.ddc); - if (edid) { - drm_connector_update_edid_property(connector, edid); - count = drm_add_edid_modes(connector, edid); - if (count) { - dp->is_connected = true; - goto out; - } - } - - - dp->is_connected = false; - - count = drm_add_modes_noedid(connector, connector->dev->mode_config.max_width, - connector->dev->mode_config.max_height); - drm_set_preferred_mode(connector, 1024, 768); // temporary implementation - -out: - kfree(edid); - - return count; -} - -static int hibmc_dp_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode, - struct drm_modeset_acquire_ctx *ctx, - enum drm_mode_status *status) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - u64 cur_val, max_val; - - if (!dp->is_connected) { - *status = MODE_OK; - return 0; - } - - cur_val = (u64)mode->htotal * mode->vtotal * drm_mode_vrefresh(mode) * BPP_24; - max_val = (u64)hibmc_dp_get_link_rate(dp) * DP_MODE_VALI_CAL * hibmc_dp_get_lanes(dp); - if (cur_val > max_val) - *status = MODE_CLOCK_HIGH; - else - *status = MODE_OK; - - return 0; -} - -static int hibmc_dp_detect(struct drm_connector *connector, - struct drm_modeset_acquire_ctx *ctx, bool force) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - - if (dp->hpd_status) - return connector_status_connected; - else - return connector_status_disconnected; -} - -static const struct drm_connector_helper_funcs hibmc_dp_conn_helper_funcs = { - .get_modes = hibmc_dp_connector_get_modes, - .mode_valid_ctx = hibmc_dp_mode_valid, - .detect_ctx = hibmc_dp_detect, -}; - -static int hibmc_dp_late_register(struct drm_connector *connector) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - - hibmc_dp_enable_int(dp); - - return drm_dp_aux_register(&dp->aux); -} - -static void hibmc_dp_early_unregister(struct drm_connector *connector) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - - drm_dp_aux_unregister(&dp->aux); - - hibmc_dp_disable_int(dp); -} - -static const struct drm_connector_funcs hibmc_dp_conn_funcs = { - .reset = drm_atomic_helper_connector_reset, - .fill_modes = drm_helper_probe_single_connector_modes, - .destroy = drm_connector_cleanup, - .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, - .late_register = hibmc_dp_late_register, - .early_unregister = hibmc_dp_early_unregister, -}; - -static inline int hibmc_dp_prepare(struct hibmc_dp *dp, struct drm_display_mode *mode) -{ - int ret; - - hibmc_dp_display_en(dp, false); - - ret = hibmc_dp_mode_set(dp, mode); - if (ret) - drm_err(dp->drm_dev, "hibmc dp mode set failed: %d\n", ret); - - return ret; -} - -static void hibmc_dp_encoder_enable(struct drm_encoder *drm_encoder, - struct drm_atomic_state *state) -{ - struct hibmc_dp *dp = container_of(drm_encoder, struct hibmc_dp, encoder); - struct drm_display_mode *mode = &drm_encoder->crtc->state->mode; - - if (hibmc_dp_prepare(dp, mode)) - return; - - hibmc_dp_display_en(dp, true); -} - -static void hibmc_dp_encoder_disable(struct drm_encoder *drm_encoder, - struct drm_atomic_state *state) -{ - struct hibmc_dp *dp = container_of(drm_encoder, struct hibmc_dp, encoder); - - hibmc_dp_display_en(dp, false); -} - -static void hibmc_dp_encoder_mode_set(struct drm_encoder *encoder, - struct drm_crtc_state *crtc_state, - struct drm_connector_state *conn_state) -{ - u32 reg; - struct drm_device *dev = encoder->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - - reg = readl(priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); - reg |= HIBMC_DISPLAY_CONTROL_FPVDDEN(1); - reg |= HIBMC_DISPLAY_CONTROL_PANELDATE(1); - reg |= HIBMC_DISPLAY_CONTROL_FPEN(1); - reg |= HIBMC_DISPLAY_CONTROL_VBIASEN(1); - writel(reg, priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); -} - -static const struct drm_encoder_helper_funcs hibmc_dp_encoder_helper_funcs = { - .atomic_enable = hibmc_dp_encoder_enable, - .atomic_disable = hibmc_dp_encoder_disable, - .atomic_mode_set = hibmc_dp_encoder_mode_set, -}; - -static const struct drm_encoder_funcs hibmc_encoder_funcs = { - .destroy = drm_encoder_cleanup, -}; - -irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg) -{ - struct drm_device *dev = (struct drm_device *)arg; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - struct hibmc_dp *dp = &priv->dp; - int idx; - - if (!drm_dev_enter(dev, &idx)) - return -ENODEV; - - if (dp->hpd_status) { /* only check unplug int when the last status is HPD in */ - if ((dp->irq_status & HIBMC_DP_MASKED_SINK_HPD_UNPLUG_INT)) { - drm_dbg_dp(dev, "HPD OUT isr occur!\n"); - hibmc_dp_reset_link(dp); - dp->hpd_status = 0; - if (dev->registered) - drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD OUT occur but err!\n"); - } - } else { - if (dp->irq_status & HIBMC_DP_MASKED_SINK_HPD_PLUG_INT) { - drm_dbg_dp(priv->dev, "HPD IN isr occur!\n"); - hibmc_dp_hpd_cfg(dp); - dp->hpd_status = 1; - if (dev->registered) - drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD IN occur but err!\n"); - } - } - - drm_dev_exit(idx); - - return IRQ_HANDLED; -} - -int hibmc_dp_init(struct hibmc_drm_private *priv) -{ - struct drm_device *dev = priv->dev; - struct drm_crtc *crtc = &priv->crtc; - struct hibmc_dp *dp = &priv->dp; - struct drm_connector *connector = &dp->connector; - struct drm_encoder *encoder = &dp->encoder; - int ret; - - dp->mmio = priv->mmio; - dp->drm_dev = dev; - - ret = hibmc_dp_hw_init(&priv->dp); - if (ret) { - drm_err(dev, "hibmc dp hw init failed: %d\n", ret); - return ret; - } - - hibmc_dp_display_en(&priv->dp, false); - - encoder->possible_crtcs = drm_crtc_mask(crtc); - ret = drm_encoder_init(dev, encoder, &hibmc_encoder_funcs, DRM_MODE_ENCODER_TMDS, NULL); - if (ret) { - drm_err(dev, "init dp encoder failed: %d\n", ret); - return ret; - } - - drm_encoder_helper_add(encoder, &hibmc_dp_encoder_helper_funcs); - - ret = drm_connector_init_with_ddc(dev, connector, &hibmc_dp_conn_funcs, - DRM_MODE_CONNECTOR_DisplayPort, &dp->aux.ddc); - if (ret) { - drm_err(dev, "init dp connector failed: %d\n", ret); - return ret; - } - - drm_connector_helper_add(connector, &hibmc_dp_conn_helper_funcs); - - drm_connector_attach_encoder(connector, encoder); - - connector->polled = DRM_CONNECTOR_POLL_HPD; - - return 0; -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c index b9398a78c26c..2723b4ae9856 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c @@ -20,17 +20,12 @@ #include <drm/drm_irq.h> #include <drm/drm_managed.h> #include <drm/drm_vblank.h> -#include <drm/drm_probe_helper.h> #include "hibmc_drm_drv.h" #include "hibmc_drm_regs.h" -#include "dp/dp_reg.h" - DEFINE_DRM_GEM_FOPS(hibmc_fops); -static const char *g_irqs_names_map[HIBMC_MAX_VECTORS] = { "hibmc-vblank", "hibmc-hpd" }; - static irqreturn_t hibmc_drm_interrupt(int irq, void *arg) { struct drm_device *dev = (struct drm_device *)arg; @@ -49,22 +44,6 @@ static irqreturn_t hibmc_drm_interrupt(int irq, void *arg) return IRQ_HANDLED; } -static irqreturn_t hibmc_dp_interrupt(int irq, void *arg) -{ - struct drm_device *dev = (struct drm_device *)arg; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - u32 status; - - status = readl(priv->mmio + HIBMC_DP_INTSTAT); - if (status) { - priv->dp.irq_status = status; - writel(status, priv->mmio + HIBMC_DP_INTCLR); - return IRQ_WAKE_THREAD; - } - - return IRQ_HANDLED; -} - static struct drm_driver hibmc_driver = { .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC, .fops = &hibmc_fops, @@ -120,35 +99,16 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) ret = hibmc_de_init(priv); if (ret) { drm_err(priv->dev, "failed to init de: %d\n", ret); - goto err; - } - - /* - * If the serdes reg is readable and is not equal to 0, - * DP block exists and initializes it. - */ - ret = readl(priv->mmio + HIBMC_DP_HOST_SERDES_CTRL); - if (ret) { - ret = hibmc_dp_init(priv); - if (ret) { - drm_err(priv->dev, "failed to init dp: %d\n", ret); - goto err; - } + return ret; } ret = hibmc_vdac_init(priv); if (ret) { drm_err(priv->dev, "failed to init vdac: %d\n", ret); - goto err; + return ret; } - drm_kms_helper_poll_init(priv->dev); return 0; - -err: - drm_atomic_helper_shutdown(priv->dev); - - return ret; } static void hibmc_kms_fini(struct hibmc_drm_private *priv) @@ -297,47 +257,20 @@ static int hibmc_hw_init(struct hibmc_drm_private *priv) return 0; } -static void hibmc_unload(struct drm_device *dev) -{ - drm_atomic_helper_shutdown(dev); - drm_kms_helper_poll_fini(dev); -} - -static int hibmc_msi_init(struct drm_device *dev) +static int hibmc_unload(struct drm_device *dev) { - struct pci_dev *pdev = to_pci_dev(dev->dev); - int valid_irq_num; - int irq; - int ret; - int i; + struct hibmc_drm_private *priv = dev->dev_private; - ret = pci_alloc_irq_vectors(pdev, HIBMC_MIN_VECTORS, - HIBMC_MAX_VECTORS, PCI_IRQ_MSI); - if (ret < 0) { - drm_err(dev, "enabling MSI failed: %d\n", ret); - return ret; - } + drm_atomic_helper_shutdown(dev); - valid_irq_num = ret; - - for (i = 0; i < valid_irq_num; i++) { - irq = pci_irq_vector(pdev, i); - - if (i) - /* PCI devices require shared interrupts. */ - ret = devm_request_threaded_irq(&pdev->dev, irq, - hibmc_dp_interrupt, - hibmc_dp_hpd_isr, - IRQF_SHARED, g_irqs_names_map[i], dev); - else - ret = devm_request_irq(&pdev->dev, irq, hibmc_drm_interrupt, - IRQF_SHARED, g_irqs_names_map[i], dev); - if (ret) { - drm_err(dev, "install irq failed: %d\n", ret); - return ret; - } - } + if (dev->irq_enabled) + drm_irq_uninstall(dev); + pci_disable_msi(dev->pdev); + hibmc_kms_fini(priv); + hibmc_mm_fini(priv); + hibmc_hw_unmap(priv); + dev->dev_private = NULL; return 0; } @@ -355,19 +288,21 @@ static int hibmc_load(struct drm_device *dev) priv->dev = dev; ret = hibmc_hw_init(priv); - if (ret) - return ret; + if (ret) { + drm_err(dev, "failed to initialize hardware: %d\n", ret); + goto err_alloc; + } ret = hibmc_mm_init(priv); if (ret) { - drm_err(dev, "Error initializing VRAM MM; %d\n", ret); - return ret; + drm_err(dev, "failed to initialize mm: %d\n", ret); + goto err_hw; } ret = hibmc_kms_init(priv); if (ret) { - drm_err(dev, "hibmc kms init failed, ret:%d\n", ret); - return ret; + drm_err(dev, "failed to initialize kms: %d\n", ret); + goto err_mm; } ret = drm_vblank_init(dev, dev->mode_config.num_crtc); @@ -376,10 +311,13 @@ static int hibmc_load(struct drm_device *dev) goto err_kms; } - ret = hibmc_msi_init(dev); + ret = pci_enable_msi(dev->pdev); if (ret) { - drm_err(dev, "hibmc msi init failed, ret:%d\n", ret); - goto err_kms; + drm_warn(dev, "enabling MSI failed: %d\n", ret); + } else { + ret = drm_irq_install(dev, dev->pdev->irq); + if (ret) + drm_warn(dev, "install irq failed: %d\n", ret); } /* reset all the states of crtc/plane/encoder/connector */ @@ -389,8 +327,11 @@ static int hibmc_load(struct drm_device *dev) err_kms: hibmc_kms_fini(priv); +err_mm: hibmc_mm_fini(priv); +err_hw: hibmc_hw_unmap(priv); +err_alloc: dev->dev_private = NULL; return ret; @@ -400,7 +341,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) { struct drm_device *dev; - struct hibmc_drm_private *priv; int ret; ret = drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, @@ -423,8 +363,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, goto err_free; } - pci_set_master(pdev); - ret = hibmc_load(dev); if (ret) { drm_err(dev, "failed to load hibmc: %d\n", ret); @@ -440,9 +378,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, drm_fbdev_generic_setup(dev, dev->mode_config.preferred_depth); - priv = to_hibmc_drm_private(dev); - hibmc_debugfs_init(&priv->dp.connector, dev->primary->debugfs_root); - return 0; err_unload: @@ -480,8 +415,8 @@ static struct pci_driver hibmc_pci_driver = { .id_table = hibmc_pci_table, .probe = hibmc_pci_probe, .remove = hibmc_pci_remove, - .shutdown = hibmc_pci_shutdown, - .driver.pm = &hibmc_pm_ops, + .shutdown = hibmc_pci_shutdown, + .driver.pm = &hibmc_pm_ops, }; module_pci_driver(hibmc_pci_driver); diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h index 617585268009..87d2aad0bb5e 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h @@ -21,16 +21,12 @@ #include <drm/drm_edid.h> #include <drm/drm_fb_helper.h> #include <drm/drm_framebuffer.h> -#include "dp/dp_hw.h" struct drm_device; -#define HIBMC_MIN_VECTORS 1 -#define HIBMC_MAX_VECTORS 2 -struct hibmc_vdac { - struct drm_device *dev; - struct drm_encoder encoder; - struct drm_connector connector; +struct hibmc_connector { + struct drm_connector base; + struct i2c_adapter adapter; struct i2c_algo_bit_data bit_data; }; @@ -46,19 +42,14 @@ struct hibmc_drm_private { struct drm_device *dev; struct drm_plane primary_plane; struct drm_crtc crtc; + struct drm_encoder encoder; + struct hibmc_connector connector; bool mode_config_initialized; - struct hibmc_vdac vdac; - struct hibmc_dp dp; }; -static inline struct hibmc_vdac *to_hibmc_vdac(struct drm_connector *connector) -{ - return container_of(connector, struct hibmc_vdac, connector); -} - -static inline struct hibmc_dp *to_hibmc_dp(struct drm_connector *connector) +static inline struct hibmc_connector *to_hibmc_connector(struct drm_connector *connector) { - return container_of(connector, struct hibmc_dp, connector); + return container_of(connector, struct hibmc_connector, base); } static inline struct hibmc_drm_private *to_hibmc_drm_private(struct drm_device *dev) @@ -78,14 +69,8 @@ int hibmc_mm_init(struct hibmc_drm_private *hibmc); void hibmc_mm_fini(struct hibmc_drm_private *hibmc); int hibmc_dumb_create(struct drm_file *file, struct drm_device *dev, struct drm_mode_create_dumb *args); -int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *connector); -void hibmc_ddc_del(struct hibmc_vdac *vdac); -int hibmc_dp_init(struct hibmc_drm_private *priv); +int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_connector *connector); extern const struct drm_mode_config_funcs hibmc_mode_funcs; -void hibmc_debugfs_init(struct drm_connector *connector, struct dentry *root); - -irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg); - #endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c index 2e0fcd2b3bc1..86d712090d87 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c @@ -25,8 +25,8 @@ static void hibmc_set_i2c_signal(void *data, u32 mask, int value) { - struct hibmc_vdac *vdac = data; - struct hibmc_drm_private *priv = to_hibmc_drm_private(vdac->connector.dev); + struct hibmc_connector *hibmc_connector = data; + struct hibmc_drm_private *priv = to_hibmc_drm_private(hibmc_connector->base.dev); u32 tmp_dir = readl(priv->mmio + GPIO_DATA_DIRECTION); if (value) { @@ -45,8 +45,8 @@ static void hibmc_set_i2c_signal(void *data, u32 mask, int value) static int hibmc_get_i2c_signal(void *data, u32 mask) { - struct hibmc_vdac *vdac = data; - struct hibmc_drm_private *priv = to_hibmc_drm_private(vdac->connector.dev); + struct hibmc_connector *hibmc_connector = data; + struct hibmc_drm_private *priv = to_hibmc_drm_private(hibmc_connector->base.dev); u32 tmp_dir = readl(priv->mmio + GPIO_DATA_DIRECTION); if ((tmp_dir & mask) != mask) { @@ -77,27 +77,23 @@ static int hibmc_ddc_getscl(void *data) return hibmc_get_i2c_signal(data, I2C_SCL_MASK); } -int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *vdac) +int hibmc_ddc_create(struct drm_device *drm_dev, + struct hibmc_connector *connector) { - vdac->adapter.owner = THIS_MODULE; - vdac->adapter.class = I2C_CLASS_DDC; - snprintf(vdac->adapter.name, I2C_NAME_SIZE, "HIS i2c bit bus"); - vdac->adapter.dev.parent = drm_dev->dev; - i2c_set_adapdata(&vdac->adapter, vdac); - vdac->adapter.algo_data = &vdac->bit_data; - - vdac->bit_data.udelay = 20; - vdac->bit_data.timeout = usecs_to_jiffies(2000); - vdac->bit_data.data = vdac; - vdac->bit_data.setsda = hibmc_ddc_setsda; - vdac->bit_data.setscl = hibmc_ddc_setscl; - vdac->bit_data.getsda = hibmc_ddc_getsda; - vdac->bit_data.getscl = hibmc_ddc_getscl; - - return i2c_bit_add_bus(&vdac->adapter); -} - -void hibmc_ddc_del(struct hibmc_vdac *vdac) -{ - i2c_del_adapter(&vdac->adapter); + connector->adapter.owner = THIS_MODULE; + connector->adapter.class = I2C_CLASS_DDC; + snprintf(connector->adapter.name, I2C_NAME_SIZE, "HIS i2c bit bus"); + connector->adapter.dev.parent = &drm_dev->pdev->dev; + i2c_set_adapdata(&connector->adapter, connector); + connector->adapter.algo_data = &connector->bit_data; + + connector->bit_data.udelay = 20; + connector->bit_data.timeout = usecs_to_jiffies(2000); + connector->bit_data.data = connector; + connector->bit_data.setsda = hibmc_ddc_setsda; + connector->bit_data.setscl = hibmc_ddc_setscl; + connector->bit_data.getsda = hibmc_ddc_getsda; + connector->bit_data.getscl = hibmc_ddc_getscl; + + return i2c_bit_add_bus(&connector->adapter); } diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c index 9c0ec6e54df0..fb761853289c 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c @@ -42,9 +42,9 @@ static int hibmc_connector_get_modes(struct drm_connector *connector) { int count; void *edid; - struct hibmc_vdac *vdac = to_hibmc_vdac(connector); + struct hibmc_connector *hibmc_connector = to_hibmc_connector(connector); - edid = drm_get_edid(connector, &vdac->adapter); + edid = drm_get_edid(connector, &hibmc_connector->adapter); if (edid) { drm_connector_update_edid_property(connector, edid); count = drm_add_edid_modes(connector, edid); @@ -88,53 +88,26 @@ static enum drm_mode_status hibmc_connector_mode_valid( return hibmc_valid_mode(mode->hdisplay, mode->vdisplay); } -static void hibmc_vdac_connector_destroy(struct drm_connector *connector) +static void hibmc_connector_destroy(struct drm_connector *connector) { - struct hibmc_vdac *vdac = to_hibmc_vdac(connector); + struct hibmc_connector *hibmc_connector = to_hibmc_connector(connector); - i2c_del_adapter(&vdac->adapter); + i2c_del_adapter(&hibmc_connector->adapter); drm_connector_cleanup(connector); } -static int hibmc_vdac_detect(struct drm_connector *connector, struct drm_modeset_acquire_ctx *ctx, - bool force) -{ - struct hibmc_drm_private *priv = to_hibmc_drm_private(connector->dev); - struct hibmc_dp *dp = &priv->dp; - - if (dp->hpd_status) - return connector_status_disconnected; - - return connector_status_connected; -} - static const struct drm_connector_helper_funcs hibmc_connector_helper_funcs = { .get_modes = hibmc_connector_get_modes, .mode_valid = hibmc_connector_mode_valid, - .detect_ctx = hibmc_vdac_detect, }; -static void hibmc_vdac_force(struct drm_connector *connector) -{ - struct hibmc_drm_private *priv = to_hibmc_drm_private(connector->dev); - struct hibmc_dp *dp = &priv->dp; - - if (dp->hpd_status) { - connector->status = connector_status_disconnected; - return; - } - - connector->status = connector_status_connected; -} - static const struct drm_connector_funcs hibmc_connector_funcs = { .fill_modes = drm_helper_probe_single_connector_modes, - .destroy = hibmc_vdac_connector_destroy, + .destroy = hibmc_connector_destroy, .reset = drm_atomic_helper_connector_reset, .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, - .force = hibmc_vdac_force, }; static void hibmc_encoder_mode_set(struct drm_encoder *encoder, @@ -164,12 +137,12 @@ static const struct drm_encoder_funcs hibmc_encoder_funcs = { int hibmc_vdac_init(struct hibmc_drm_private *priv) { struct drm_device *dev = priv->dev; - struct hibmc_vdac *vdac = &priv->vdac; - struct drm_encoder *encoder = &vdac->encoder; - struct drm_connector *connector = &vdac->connector; + struct hibmc_connector *hibmc_connector = &priv->connector; + struct drm_encoder *encoder = &priv->encoder; + struct drm_connector *connector = &hibmc_connector->base; int ret; - ret = hibmc_ddc_create(dev, vdac); + ret = hibmc_ddc_create(dev, hibmc_connector); if (ret) { drm_err(dev, "failed to create ddc: %d\n", ret); return ret; @@ -180,7 +153,7 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) DRM_MODE_ENCODER_DAC, NULL); if (ret) { drm_err(dev, "failed to init encoder: %d\n", ret); - goto err; + return ret; } drm_encoder_helper_add(encoder, &hibmc_encoder_helper_funcs); @@ -188,21 +161,14 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) ret = drm_connector_init_with_ddc(dev, connector, &hibmc_connector_funcs, DRM_MODE_CONNECTOR_VGA, - &vdac->adapter); + &hibmc_connector->adapter); if (ret) { drm_err(dev, "failed to init connector: %d\n", ret); - goto err; + return ret; } drm_connector_helper_add(connector, &hibmc_connector_helper_funcs); drm_connector_attach_encoder(connector, encoder); - connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT; - return 0; - -err: - hibmc_ddc_del(vdac); - - return ret; } diff --git a/include/drm/drm_probe_helper.h b/include/drm/drm_probe_helper.h index 621885d5de84..8d3ed2834d34 100644 --- a/include/drm/drm_probe_helper.h +++ b/include/drm/drm_probe_helper.h @@ -24,7 +24,4 @@ void drm_kms_helper_poll_disable(struct drm_device *dev); void drm_kms_helper_poll_enable(struct drm_device *dev); bool drm_kms_helper_is_poll_worker(void); -int drm_connector_helper_detect_from_ddc(struct drm_connector *connector, - struct drm_modeset_acquire_ctx *ctx, - bool force); #endif -- 2.34.1

2 1

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h arch/x86/kernel/cpu/microcode/amd.c [move the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/include/asm/cpu.h | 12 ++++++++++ arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++ arch/x86/kernel/cpu/microcode/amd.c | 12 ---------- 3 files changed, 47 insertions(+), 12 deletions(-) diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h index 43a228e11209..d252aa7f04fb 100644 --- a/arch/x86/include/asm/cpu.h +++ b/arch/x86/include/asm/cpu.h @@ -84,4 +84,16 @@ int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type); extern struct cpumask cpus_stop_mask; +union zen_patch_rev { + struct { + __u32 rev : 8, + stepping : 4, + model : 4, + __reserved : 4, + ext_model : 4, + ext_fam : 8; + }; + __u32 ucode_rev; +}; + #endif /* _ASM_X86_CPU_H */ diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index b6990dc26274..75746a991f8e 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -96,18 +96,6 @@ static struct equiv_cpu_table { struct equiv_cpu_entry *entry; } equiv_table; -union zen_patch_rev { - struct { - __u32 rev : 8, - stepping : 4, - model : 4, - __reserved : 4, - ext_model : 4, - ext_fam : 8; - }; - __u32 ucode_rev; -}; - union cpuid_1_eax { struct { __u32 stepping : 4, -- 2.34.1

2 1

[PATCH OLK-5.10] Revert "drm/hisilicon/hibmc: hibmc-drm bugfix for DP"
by Tengda Wu 06 Feb '26

06 Feb '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13655 ------------------------------------------ This reverts commit 70dcc68078ac0303c412b9dedfddcc0a850e29f1. Commit 70dcc68078ac introduced a null-pointer dereference exception, causing kernel boot failure: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 Call trace: hibmc_debugfs_init+0x38/0x68 [hibmc_drm] hibmc_pci_probe+0xdc/0x1ac [hibmc_drm] local_pci_probe+0x48/0xb0 work_for_cpu_fn+0x24/0x50 process_one_work+0x1d8/0x4c0 worker_thread+0x25c/0x470 kthread+0x108/0x150 Temporarily revert this patch to circumvent the issue. Fixes: 70dcc68078ac ("drm/hisilicon/hibmc: hibmc-drm bugfix for DP") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 5 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 83 ++++++------------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 9 -- drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 67 ++++----------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 10 +-- .../gpu/drm/hisilicon/hibmc/dp/dp_serdes.c | 12 +++ .../drm/hisilicon/hibmc/hibmc_drm_debugfs.c | 49 +---------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 65 --------------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 37 ++++----- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 1 - .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 5 -- .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 13 +-- 12 files changed, 77 insertions(+), 279 deletions(-) diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h index 1107e10b2047..4bbe6b567056 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h @@ -15,7 +15,6 @@ #include "dp_hw.h" -#define HIBMC_DP_LINK_RATE_CAL 27 #define HIBMC_DP_LANE_NUM_MAX 2 struct hibmc_link_status { @@ -26,9 +25,6 @@ struct hibmc_link_status { struct hibmc_link_cap { u8 link_rate; u8 lanes; - int rx_dpcd_revision; - bool is_tps3; - bool is_tps4; }; struct hibmc_dp_link { @@ -67,6 +63,7 @@ struct hibmc_dp_dev { void hibmc_dp_aux_init(struct hibmc_dp *dp); int hibmc_dp_link_training(struct hibmc_dp_dev *dp); +int hibmc_dp_serdes_init(struct hibmc_dp_dev *dp); int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp); int hibmc_dp_serdes_set_tx_cfg(struct hibmc_dp_dev *dp, u8 train_set[HIBMC_DP_LANE_NUM_MAX]); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c index 9e8f95d957f2..8f0daec7d174 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c @@ -154,6 +154,7 @@ int hibmc_dp_hw_init(struct hibmc_dp *dp) { struct drm_device *drm_dev = dp->drm_dev; struct hibmc_dp_dev *dp_dev; + int ret; dp_dev = devm_kzalloc(drm_dev->dev, sizeof(struct hibmc_dp_dev), GFP_KERNEL); if (!dp_dev) @@ -165,22 +166,23 @@ int hibmc_dp_hw_init(struct hibmc_dp *dp) dp_dev->dev = drm_dev; dp_dev->base = dp->mmio + HIBMC_DP_OFFSET; - dp_dev->serdes_base = dp_dev->base + HIBMC_DP_HOST_OFFSET; hibmc_dp_aux_init(dp); + ret = hibmc_dp_serdes_init(dp_dev); + if (ret) + return ret; + dp_dev->link.cap.lanes = 0x2; dp_dev->link.cap.link_rate = DP_LINK_BW_8_1; + /* hdcp data */ + writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); /* int init */ writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); /* rst */ - writel(0, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - usleep_range(30, 50); writel(HIBMC_DP_DPTX_RST, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - /* hdcp data */ - writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); /* clock enable */ writel(HIBMC_DP_CLK_EN, dp_dev->base + HIBMC_DP_DPTX_CLK_CTRL); @@ -222,17 +224,14 @@ void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable) struct hibmc_dp_dev *dp_dev = dp->dp_dev; if (enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, - HIBMC_DP_CFG_MST_ENABLE, 0x1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, BIT(0), 0x1); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0x1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, BIT(10), 0x1); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } else { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, BIT(10), 0); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_MST_ENABLE, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, BIT(0), 0); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } @@ -258,36 +257,10 @@ int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode) return 0; } -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.link_rate; -} - -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.lanes; -} - -int hibmc_dp_get_dpcd(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.rx_dpcd_revision; -} - void hibmc_dp_reset_link(struct hibmc_dp *dp) { - if (dp->dp_dev) { - dp->dp_dev->link.status.clock_recovered = false; - dp->dp_dev->link.status.channel_equalized = false; - } + dp->dp_dev->link.status.clock_recovered = false; + dp->dp_dev->link.status.channel_equalized = false; } static const struct hibmc_dp_color_raw g_rgb_raw[] = { @@ -309,30 +282,26 @@ void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg) struct hibmc_dp_color_raw raw_data; if (cfg->enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_TIMING_SEL_M, cfg->self_timing); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_CTRL_M, cfg->dynamic_rate); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(9), + cfg->self_timing); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, GENMASK(8, 1), + cfg->dynamic_rate); if (cfg->pattern == CBAR_COLOR_BAR) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(10), 0); } else { raw_data = g_rgb_raw[cfg->pattern]; drm_dbg_dp(dp->drm_dev, "r:%x g:%x b:%x\n", raw_data.r_value, raw_data.g_value, raw_data.b_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 1); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_DATA_R_M, raw_data.r_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_G_M, raw_data.g_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_B_M, raw_data.b_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(10), 1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, GENMASK(23, 12), + raw_data.r_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, GENMASK(23, 12), + raw_data.g_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, GENMASK(11, 0), + raw_data.b_value); } } - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_ENABLE_M, cfg->enable); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(0), cfg->enable); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } - diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h index 4740db06e1b0..f55d78d266f2 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h @@ -12,10 +12,6 @@ #include <drm/drm_print.h> #include <drm/drm_dp_helper.h> -// 27 * 10000000 * 80% = 216000000 -#define DP_MODE_VALI_CAL 216000000 -#define BPP_24 24 - struct hibmc_dp_dev; enum hibmc_dp_cbar_pattern { @@ -55,16 +51,11 @@ struct hibmc_dp { struct hibmc_dp_cbar_cfg cfg; u32 irq_status; int hpd_status; - bool is_connected; }; int hibmc_dp_hw_init(struct hibmc_dp *dp); int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode); void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable); -struct edid *hibmc_dp_get_edid(struct hibmc_dp *dp); -int hibmc_dp_get_dpcd(struct hibmc_dp *dp); -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp); -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp); void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg); void hibmc_dp_reset_link(struct hibmc_dp *dp); void hibmc_dp_hpd_cfg(struct hibmc_dp *dp); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c index 9b632428fec6..c3e648e2f1a8 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c @@ -39,14 +39,6 @@ static int hibmc_dp_link_training_configure(struct hibmc_dp_dev *dp) /* enhanced frame */ hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_FRAME_MODE, 0x1); - ret = hibmc_dp_get_serdes_rate_cfg(dp); - if (ret < 0) - return ret; - - ret = hibmc_dp_serdes_rate_switch(ret, dp); - if (ret) - return ret; - /* set rate and lane count */ buf[0] = dp->link.cap.link_rate; buf[1] = DP_LANE_COUNT_ENHANCED_FRAME_EN | dp->link.cap.lanes; @@ -209,23 +201,21 @@ static int hibmc_dp_link_training_cr(struct hibmc_dp_dev *dp) bool level_changed; u32 voltage_tries; u32 cr_tries; - u32 max_cr; int ret; /* * DP 1.4 spec define 10 for maxtries value, for pre DP 1.4 version set a limit of 80 * (4 voltage levels x 4 preemphasis levels x 5 identical voltage retries) */ - max_cr = dp->link.cap.rx_dpcd_revision >= DP_DPCD_REV_14 ? 10 : 80; voltage_tries = 1; - for (cr_tries = 0; cr_tries < max_cr; cr_tries++) { + for (cr_tries = 0; cr_tries < 80; cr_tries++) { drm_dp_link_train_clock_recovery_delay(dp->dpcd); ret = drm_dp_dpcd_read_link_status(dp->aux, lane_status); if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "Get lane status failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; + drm_err(dp->dev, "Get lane status failed\n"); + return ret; } if (drm_dp_clock_recovery_ok(lane_status, dp->link.cap.lanes)) { @@ -256,7 +246,7 @@ static int hibmc_dp_link_training_cr(struct hibmc_dp_dev *dp) voltage_tries = level_changed ? 1 : voltage_tries + 1; } - drm_err(dp->dev, "dp link training clock recovery %u timers failed\n", max_cr); + drm_err(dp->dev, "dp link training clock recovery 80 times failed\n"); dp->link.status.clock_recovered = false; return 0; @@ -266,17 +256,9 @@ static int hibmc_dp_link_training_channel_eq(struct hibmc_dp_dev *dp) { u8 lane_status[DP_LINK_STATUS_SIZE] = {0}; u8 eq_tries; - int tps; int ret; - if (dp->link.cap.is_tps4) - tps = DP_TRAINING_PATTERN_4; - else if (dp->link.cap.is_tps3) - tps = DP_TRAINING_PATTERN_3; - else - tps = DP_TRAINING_PATTERN_2; - - ret = hibmc_dp_link_set_pattern(dp, tps); + ret = hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_2); if (ret) return ret; @@ -306,7 +288,7 @@ static int hibmc_dp_link_training_channel_eq(struct hibmc_dp_dev *dp) ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); if (ret) - break; + return ret; ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, dp->link.train_set, dp->link.cap.lanes); @@ -335,17 +317,7 @@ static int hibmc_dp_link_downgrade_training_cr(struct hibmc_dp_dev *dp) static int hibmc_dp_link_downgrade_training_eq(struct hibmc_dp_dev *dp) { - u8 status[DP_LINK_STATUS_SIZE] = {0}; - int ret; - - ret = drm_dp_dpcd_read_link_status(dp->aux, status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "get lane status failed\n"); - return ret >= 0 ? -EIO : ret; - } - - if ((dp->link.status.clock_recovered && !dp->link.status.channel_equalized) || - (status[0] != 0 && !dp->link.status.clock_recovered)) { // at least one cr_done + if ((dp->link.status.clock_recovered && !dp->link.status.channel_equalized)) { if (!hibmc_dp_link_reduce_lane(dp)) return 0; } @@ -353,20 +325,6 @@ static int hibmc_dp_link_downgrade_training_eq(struct hibmc_dp_dev *dp) return hibmc_dp_link_reduce_rate(dp); } -static void hibmc_dp_update_caps(struct hibmc_dp_dev *dp) -{ - dp->link.cap.rx_dpcd_revision = dp->dpcd[DP_DPCD_REV]; - - dp->link.cap.is_tps3 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_13) && - (dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED); - dp->link.cap.is_tps4 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_14) && - (dp->dpcd[DP_MAX_DOWNSPREAD] & DP_TPS4_SUPPORTED); - dp->link.cap.link_rate = dp->dpcd[DP_MAX_LINK_RATE]; - dp->link.cap.lanes = dp->dpcd[DP_MAX_LANE_COUNT] & DP_MAX_LANE_COUNT_MASK; - if (dp->link.cap.lanes > HIBMC_DP_LANE_NUM_MAX) - dp->link.cap.lanes = HIBMC_DP_LANE_NUM_MAX; -} - int hibmc_dp_link_training(struct hibmc_dp_dev *dp) { struct hibmc_dp_link *link = &dp->link; @@ -376,7 +334,16 @@ int hibmc_dp_link_training(struct hibmc_dp_dev *dp) if (ret) drm_err(dp->dev, "dp aux read dpcd failed, ret: %d\n", ret); - hibmc_dp_update_caps(dp); + dp->link.cap.link_rate = dp->dpcd[DP_MAX_LINK_RATE]; + dp->link.cap.lanes = 0x2; + + ret = hibmc_dp_get_serdes_rate_cfg(dp); + if (ret < 0) + return ret; + + ret = hibmc_dp_serdes_rate_switch(ret, dp); + if (ret) + return ret; while (true) { ret = hibmc_dp_link_training_cr_pre(dp); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h index 156e5d63c47f..394b1e933c3a 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h @@ -68,14 +68,8 @@ #define HIBMC_DP_CFG_STREAM_HBLANK_SIZE GENMASK(15, 0) #define HIBMC_DP_COLOR_BAR_CTRL 0x260 -#define HIBMC_DP_COLOR_BAR_ENABLE_M BIT(0) -#define HIBMC_DP_COLOR_BAR_CTRL_M GENMASK(8, 1) -#define HIBMC_DP_COLOR_BAR_TIMING_SEL_M BIT(9) -#define HIBMC_DP_COLOR_BAR_PATTERN_SEL_M BIT(10) -#define HIBMC_DP_COLOR_BAR_DATA_R_M GENMASK(23, 12) #define HIBMC_DP_COLOR_BAR_CTRL1 0x264 -#define HIBMC_DP_COLOR_BAR_DATA_B_M GENMASK(11, 0) -#define HIBMC_DP_COLOR_BAR_DATA_G_M GENMASK(23, 12) + #define HIBMC_DP_TIMING_GEN_CONFIG0 0x26c #define HIBMC_DP_CFG_TIMING_GEN0_HACTIVE GENMASK(31, 16) #define HIBMC_DP_CFG_TIMING_GEN0_HBLANK GENMASK(15, 0) @@ -96,8 +90,6 @@ #define HIBMC_DP_DPTX_GCTL0 0x708 #define HIBMC_DP_CFG_PHY_LANE_NUM GENMASK(2, 1) -#define HIBMC_DP_CFG_TIMING_GEN_ENABLE BIT(10) -#define HIBMC_DP_CFG_MST_ENABLE BIT(0) #define HIBMC_DP_INTR_ENABLE 0x720 #define HIBMC_DP_INTR_ORIGINAL_STATUS 0x728 diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c index 8191233aa965..676059d4c1e6 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c @@ -57,3 +57,15 @@ int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp) return 0; } + +int hibmc_dp_serdes_init(struct hibmc_dp_dev *dp) +{ + dp->serdes_base = dp->base + HIBMC_DP_HOST_OFFSET; + + writel(FIELD_PREP(HIBMC_DP_PMA_TXDEEMPH, DP_SERDES_VOL0_PRE0), + dp->serdes_base + HIBMC_DP_PMA_LANE0_OFFSET); + writel(FIELD_PREP(HIBMC_DP_PMA_TXDEEMPH, DP_SERDES_VOL0_PRE0), + dp->serdes_base + HIBMC_DP_PMA_LANE1_OFFSET); + + return hibmc_dp_serdes_rate_switch(DP_SERDES_BW_8_1, dp); +} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c index 6c6ff3255d15..83d2cd48f81c 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c @@ -15,44 +15,6 @@ #define MAX_BUF_SIZE 12 -static int hibmc_dp_show(struct seq_file *m, void *arg) -{ - struct drm_info_node *node = m->private; - struct drm_device *dev = node->minor->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - int idx, rate; - - if (!drm_dev_enter(dev, &idx)) - return -ENODEV; - - switch (hibmc_dp_get_link_rate(&priv->dp)) { - case 0x1e: - rate = 810; // 8.1Gbps - break; - case 0x14: - rate = 540; // 5.4Gbps - break; - case 0xA: - rate = 270; // 2.7Gbps - break; - case 0x6: - rate = 162; // 1.62Gbps - break; - default: - rate = 0; - } - - seq_printf(m, "enable lanes: %u\n", hibmc_dp_get_lanes(&priv->dp)); - seq_printf(m, "link rate: %d\n", rate); - seq_printf(m, "vfresh: %d\n", drm_mode_vrefresh(&priv->crtc.mode)); - seq_printf(m, "dpcd version: 0x%x\n", hibmc_dp_get_dpcd(&priv->dp)); - seq_printf(m, "hpd status: %d\n", priv->dp.hpd_status); - - drm_dev_exit(idx); - - return 0; -} - static ssize_t hibmc_control_write(struct file *file, const char __user *user_buf, size_t count, loff_t *ppos) { @@ -131,19 +93,12 @@ static const struct file_operations hibmc_dbg_fops = { .release = single_release, }; -static struct drm_info_list hibmc_debugfs_list[] = { - { "hibmc-dp", hibmc_dp_show }, -}; - void hibmc_debugfs_init(struct drm_connector *connector, struct dentry *root) { struct drm_device *dev = connector->dev; struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - struct drm_minor *minor = dev->primary; /* create the file in drm directory, so we don't need to remove manually */ - debugfs_create_file("colorbar-cfg", 0200, root, priv, &hibmc_dbg_fops); - - drm_debugfs_create_files(hibmc_debugfs_list, ARRAY_SIZE(hibmc_debugfs_list), - minor->debugfs_root, minor); + debugfs_create_file("colorbar-cfg", 0200, + root, priv, &hibmc_dbg_fops); } diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c index ae6f5c235e02..c2cda042c736 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c @@ -11,7 +11,6 @@ #include <drm/drm_edid.h> #include "hibmc_drm_drv.h" -#include "hibmc_drm_regs.h" #include "dp/dp_hw.h" #define HIBMC_DP_MASKED_SINK_HPD_PLUG_INT BIT(2) @@ -20,56 +19,14 @@ static int hibmc_dp_connector_get_modes(struct drm_connector *connector) { int count; - struct hibmc_dp *dp = to_hibmc_dp(connector); - struct edid *edid; - - - edid = drm_get_edid(connector, &dp->aux.ddc); - if (edid) { - drm_connector_update_edid_property(connector, edid); - count = drm_add_edid_modes(connector, edid); - if (count) { - dp->is_connected = true; - goto out; - } - } - - - dp->is_connected = false; count = drm_add_modes_noedid(connector, connector->dev->mode_config.max_width, connector->dev->mode_config.max_height); drm_set_preferred_mode(connector, 1024, 768); // temporary implementation -out: - kfree(edid); - return count; } -static int hibmc_dp_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode, - struct drm_modeset_acquire_ctx *ctx, - enum drm_mode_status *status) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - u64 cur_val, max_val; - - if (!dp->is_connected) { - *status = MODE_OK; - return 0; - } - - cur_val = (u64)mode->htotal * mode->vtotal * drm_mode_vrefresh(mode) * BPP_24; - max_val = (u64)hibmc_dp_get_link_rate(dp) * DP_MODE_VALI_CAL * hibmc_dp_get_lanes(dp); - if (cur_val > max_val) - *status = MODE_CLOCK_HIGH; - else - *status = MODE_OK; - - return 0; -} - static int hibmc_dp_detect(struct drm_connector *connector, struct drm_modeset_acquire_ctx *ctx, bool force) { @@ -83,7 +40,6 @@ static int hibmc_dp_detect(struct drm_connector *connector, static const struct drm_connector_helper_funcs hibmc_dp_conn_helper_funcs = { .get_modes = hibmc_dp_connector_get_modes, - .mode_valid_ctx = hibmc_dp_mode_valid, .detect_ctx = hibmc_dp_detect, }; @@ -148,26 +104,9 @@ static void hibmc_dp_encoder_disable(struct drm_encoder *drm_encoder, hibmc_dp_display_en(dp, false); } -static void hibmc_dp_encoder_mode_set(struct drm_encoder *encoder, - struct drm_crtc_state *crtc_state, - struct drm_connector_state *conn_state) -{ - u32 reg; - struct drm_device *dev = encoder->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - - reg = readl(priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); - reg |= HIBMC_DISPLAY_CONTROL_FPVDDEN(1); - reg |= HIBMC_DISPLAY_CONTROL_PANELDATE(1); - reg |= HIBMC_DISPLAY_CONTROL_FPEN(1); - reg |= HIBMC_DISPLAY_CONTROL_VBIASEN(1); - writel(reg, priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); -} - static const struct drm_encoder_helper_funcs hibmc_dp_encoder_helper_funcs = { .atomic_enable = hibmc_dp_encoder_enable, .atomic_disable = hibmc_dp_encoder_disable, - .atomic_mode_set = hibmc_dp_encoder_mode_set, }; static const struct drm_encoder_funcs hibmc_encoder_funcs = { @@ -191,8 +130,6 @@ irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg) dp->hpd_status = 0; if (dev->registered) drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD OUT occur but err!\n"); } } else { if (dp->irq_status & HIBMC_DP_MASKED_SINK_HPD_PLUG_INT) { @@ -201,8 +138,6 @@ irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg) dp->hpd_status = 1; if (dev->registered) drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD IN occur but err!\n"); } } diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c index b9398a78c26c..147354daed84 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c @@ -20,7 +20,6 @@ #include <drm/drm_irq.h> #include <drm/drm_managed.h> #include <drm/drm_vblank.h> -#include <drm/drm_probe_helper.h> #include "hibmc_drm_drv.h" #include "hibmc_drm_regs.h" @@ -120,7 +119,7 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) ret = hibmc_de_init(priv); if (ret) { drm_err(priv->dev, "failed to init de: %d\n", ret); - goto err; + return ret; } /* @@ -130,25 +129,17 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) ret = readl(priv->mmio + HIBMC_DP_HOST_SERDES_CTRL); if (ret) { ret = hibmc_dp_init(priv); - if (ret) { + if (ret) drm_err(priv->dev, "failed to init dp: %d\n", ret); - goto err; - } } ret = hibmc_vdac_init(priv); if (ret) { drm_err(priv->dev, "failed to init vdac: %d\n", ret); - goto err; + return ret; } - drm_kms_helper_poll_init(priv->dev); return 0; - -err: - drm_atomic_helper_shutdown(priv->dev); - - return ret; } static void hibmc_kms_fini(struct hibmc_drm_private *priv) @@ -300,7 +291,6 @@ static int hibmc_hw_init(struct hibmc_drm_private *priv) static void hibmc_unload(struct drm_device *dev) { drm_atomic_helper_shutdown(dev); - drm_kms_helper_poll_fini(dev); } static int hibmc_msi_init(struct drm_device *dev) @@ -355,19 +345,21 @@ static int hibmc_load(struct drm_device *dev) priv->dev = dev; ret = hibmc_hw_init(priv); - if (ret) - return ret; + if (ret) { + drm_err(dev, "failed to initialize hardware: %d\n", ret); + goto err_alloc; + } ret = hibmc_mm_init(priv); if (ret) { - drm_err(dev, "Error initializing VRAM MM; %d\n", ret); - return ret; + drm_err(dev, "failed to initialize mm: %d\n", ret); + goto err_hw; } ret = hibmc_kms_init(priv); if (ret) { - drm_err(dev, "hibmc kms init failed, ret:%d\n", ret); - return ret; + drm_err(dev, "failed to initialize kms: %d\n", ret); + goto err_mm; } ret = drm_vblank_init(dev, dev->mode_config.num_crtc); @@ -389,8 +381,11 @@ static int hibmc_load(struct drm_device *dev) err_kms: hibmc_kms_fini(priv); +err_mm: hibmc_mm_fini(priv); +err_hw: hibmc_hw_unmap(priv); +err_alloc: dev->dev_private = NULL; return ret; @@ -400,7 +395,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) { struct drm_device *dev; - struct hibmc_drm_private *priv; int ret; ret = drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, @@ -440,9 +434,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, drm_fbdev_generic_setup(dev, dev->mode_config.preferred_depth); - priv = to_hibmc_drm_private(dev); - hibmc_debugfs_init(&priv->dp.connector, dev->primary->debugfs_root); - return 0; err_unload: diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h index 617585268009..0b0addca37f9 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h @@ -79,7 +79,6 @@ void hibmc_mm_fini(struct hibmc_drm_private *hibmc); int hibmc_dumb_create(struct drm_file *file, struct drm_device *dev, struct drm_mode_create_dumb *args); int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *connector); -void hibmc_ddc_del(struct hibmc_vdac *vdac); int hibmc_dp_init(struct hibmc_drm_private *priv); extern const struct drm_mode_config_funcs hibmc_mode_funcs; diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c index 2e0fcd2b3bc1..4f801c0fbd96 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c @@ -96,8 +96,3 @@ int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *vdac) return i2c_bit_add_bus(&vdac->adapter); } - -void hibmc_ddc_del(struct hibmc_vdac *vdac) -{ - i2c_del_adapter(&vdac->adapter); -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c index 9c0ec6e54df0..f183dd819daf 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c @@ -88,7 +88,7 @@ static enum drm_mode_status hibmc_connector_mode_valid( return hibmc_valid_mode(mode->hdisplay, mode->vdisplay); } -static void hibmc_vdac_connector_destroy(struct drm_connector *connector) +static void hibmc_connector_destroy(struct drm_connector *connector) { struct hibmc_vdac *vdac = to_hibmc_vdac(connector); @@ -130,7 +130,7 @@ static void hibmc_vdac_force(struct drm_connector *connector) static const struct drm_connector_funcs hibmc_connector_funcs = { .fill_modes = drm_helper_probe_single_connector_modes, - .destroy = hibmc_vdac_connector_destroy, + .destroy = hibmc_connector_destroy, .reset = drm_atomic_helper_connector_reset, .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, @@ -180,7 +180,7 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) DRM_MODE_ENCODER_DAC, NULL); if (ret) { drm_err(dev, "failed to init encoder: %d\n", ret); - goto err; + return ret; } drm_encoder_helper_add(encoder, &hibmc_encoder_helper_funcs); @@ -191,7 +191,7 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) &vdac->adapter); if (ret) { drm_err(dev, "failed to init connector: %d\n", ret); - goto err; + return ret; } drm_connector_helper_add(connector, &hibmc_connector_helper_funcs); @@ -200,9 +200,4 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT; return 0; - -err: - hibmc_ddc_del(vdac); - - return ret; } -- 2.34.1

2 1

[PATCH v2 OLK-6.6 0/3] Fix CVE-2025-21696
by Ze Zuo 06 Feb '26

06 Feb '26

Fix CVE-2025-21696. change since v1: - fix kabi breakage due to first patch. Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() Ze Zuo (1): userfaultfd: fix kabi breakage due to struct userfaultfd_ctx fs/userfaultfd.c | 39 -------------------------- include/linux/userfaultfd_k.h | 53 +++++++++++++++++++++++++++++++++++ mm/huge_memory.c | 12 ++++++++ mm/hugetlb.c | 14 ++++++++- mm/mremap.c | 32 ++++++++++++++++++++- 5 files changed, 109 insertions(+), 41 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h [Add the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.6.122 commit 19b2c3f3ca1b4b6dccd2a42aca2692d8c79c4214 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13639 CVE: CVE-2026-23107 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ea8ccfddbce0bee6310da4f3fc560ad520f5e6b4 upstream. The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME. Consequently, restoring a ZA context can place a task into an invalid state where TIF_SME is set but the task's sve_state is NULL. In legitimate but uncommon cases where the ZA signal context was NOT created by the kernel in the context of the same task (e.g. if the task is saved/restored with something like CRIU), we have no guarantee that sve_state had been allocated previously. In these cases, userspace can enter streaming mode without trapping while sve_state is NULL, causing a later NULL pointer dereference when the kernel attempts to store the register state: | # ./sigreturn-za | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000096000046 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x06: level 2 translation fault | Data abort info: | ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 52-bit VAs, pgdp=0000000101f47c00 | [0000000000000000] pgd=08000001021d8403, p4d=0800000102274403, pud=0800000102275403, pmd=0000000000000000 | Internal error: Oops: 0000000096000046 [#1] SMP | Modules linked in: | CPU: 0 UID: 0 PID: 153 Comm: sigreturn-za Not tainted 6.19.0-rc1 #1 PREEMPT | Hardware name: linux,dummy-virt (DT) | pstate: 214000c9 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : sve_save_state+0x4/0xf0 | lr : fpsimd_save_user_state+0xb0/0x1c0 | sp : ffff80008070bcc0 | x29: ffff80008070bcc0 x28: fff00000c1ca4c40 x27: 63cfa172fb5cf658 | x26: fff00000c1ca5228 x25: 0000000000000000 x24: 0000000000000000 | x23: 0000000000000000 x22: fff00000c1ca4c40 x21: fff00000c1ca4c40 | x20: 0000000000000020 x19: fff00000ff6900f0 x18: 0000000000000000 | x17: fff05e8e0311f000 x16: 0000000000000000 x15: 028fca8f3bdaf21c | x14: 0000000000000212 x13: fff00000c0209f10 x12: 0000000000000020 | x11: 0000000000200b20 x10: 0000000000000000 x9 : fff00000ff69dcc0 | x8 : 00000000000003f2 x7 : 0000000000000001 x6 : fff00000c1ca5b48 | x5 : fff05e8e0311f000 x4 : 0000000008000000 x3 : 0000000000000000 | x2 : 0000000000000001 x1 : fff00000c1ca5970 x0 : 0000000000000440 | Call trace: | sve_save_state+0x4/0xf0 (P) | fpsimd_thread_switch+0x48/0x198 | __switch_to+0x20/0x1c0 | __schedule+0x36c/0xce0 | schedule+0x34/0x11c | exit_to_user_mode_loop+0x124/0x188 | el0_interrupt+0xc8/0xd8 | __el0_irq_handler_common+0x18/0x24 | el0t_64_irq_handler+0x10/0x1c | el0t_64_irq+0x198/0x19c | Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800) | ---[ end trace 0000000000000000 ]--- Fix this by having restore_za_context() ensure that the task's sve_state is allocated, matching what we do when taking an SME trap. Any live SVE/SSVE state (which is restored earlier from a separate signal context) must be preserved, and hence this is not zeroed. Fixes: 39782210eb7e ("arm64/sme: Implement ZA signal handling") Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Mark Brown <broonie(a)kernel.org> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/kernel/signal.c [conflict because ce514000da4f ("arm64/sme: Rename za_state to sme_state")] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/kernel/signal.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index a0c85bb01751..d8c9434f975e 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -363,6 +363,10 @@ int restore_za_context(struct user_ctxs *user) fpsimd_flush_task_state(current); /* From now, fpsimd_thread_switch() won't touch thread.sve_state */ + sve_alloc(current, false); + if (!current->thread.sve_state) + return -ENOMEM; + sme_alloc(current, true); if (!current->thread.za_state) { current->thread.svcr &= ~SVCR_ZA_MASK; -- 2.34.1

2 1

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h [Add the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-5.10] irqchip/gic-v3-its: Avoid truncating memory addresses
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v6.6.122 commit 1b323391560354d8c515de8658b057a1daa82adb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13618 CVE: CVE-2026-23085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream. On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/irqchip/irq-gic-v3-its.c [ conflict becasue 5ddbc909f82a ("[Backport] irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1") not merged. ] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index fbe83b657dcc..8cac29a0996c 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -954,7 +954,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr; u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites); itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt); @@ -1184,7 +1184,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long vpt_addr, vconf_addr; + phys_addr_t vpt_addr, vconf_addr; u64 target; bool alloc; @@ -2891,10 +2891,10 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, baser->psz = psz; tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz; - pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n", + pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n", &its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp), its_base_type_string[type], - (unsigned long)virt_to_phys(base), + (u64)virt_to_phys(base), indirect ? "indirect" : "flat", (int)esz, psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -- 2.34.1

2 1

[PATCH OLK-6.6] irqchip/gic-v3-its: Avoid truncating memory addresses
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v6.6.122 commit 1b323391560354d8c515de8658b057a1daa82adb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13618 CVE: CVE-2026-23085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream. On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index c8e327f96303..a9802a3870db 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -978,7 +978,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr; u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites); itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt); @@ -1208,7 +1208,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, struct its_cmd_desc *desc) { struct its_vpe *vpe = valid_vpe(its, desc->its_vmapp_cmd.vpe); - unsigned long vpt_addr, vconf_addr; + phys_addr_t vpt_addr, vconf_addr; u64 target; bool alloc; @@ -2836,10 +2836,10 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, baser->psz = psz; tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz; - pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n", + pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n", &its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp), its_base_type_string[type], - (unsigned long)virt_to_phys(base), + (u64)virt_to_phys(base), indirect ? "indirect" : "flat", (int)esz, psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -- 2.34.1

2 1

[PATCH OLK-6.6 00/10] fix CVE-2024-50102
by Qi Xi 06 Feb '26

06 Feb '26

*** BLURB HERE *** David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (6): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue x86: uaccess: don't use runtime-const rewriting in modules Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 65 ++++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 14 +++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 157 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 11

[PATCH OLK-5.10 0/1] CVE-2023-53712
by Liu Mingrui 06 Feb '26

06 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2023-53712 Mårten Lindahl (1): ARM: 9317/1: kexec: Make smp stop calls asynchronous arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/17] backport some net bugfix from 6.6 lts
by Zhang Changzhong 06 Feb '26

06 Feb '26

Alexey Simakov (1): sctp: avoid NULL dereference when chunk data buffer is missing Eric Dumazet (2): sctp: initialize more fields in sctp_v6_from_sk() sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Hans de Goede (1): net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Ido Schimmel (1): nexthop: Forbid FDB status change while nexthop is in a group Ilya Dryomov (1): libceph: fix potential use-after-free in have_mon_and_osd_map() Kuniyuki Iwashima (3): tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). tipc: Fix use-after-free in tipc_mon_reinit_self(). tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). Paul Chaignon (1): bpf: Explicitly check accesses to bpf_sock_addr Slavin Liu (1): ipvs: Defer ip_vs_ftp unregister during netns cleanup Stefan Wiehler (3): sctp: Hold RCU read lock while iterating over address list sctp: Prevent TOCTOU out-of-bounds write sctp: Hold sock lock while iterating over address list Wang Liang (1): netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm ziming zhang (2): libceph: prevent potential out-of-bounds writes in handle_auth_session_key() libceph: replace BUG_ON with bounds check for map->max_osd net/bridge/br_netfilter_hooks.c | 3 --- net/ceph/auth_x.c | 2 ++ net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++---------------- net/ceph/debugfs.c | 14 +++++++---- net/ceph/osdmap.c | 18 ++++++++------ net/core/filter.c | 16 ++++++++----- net/ipv4/nexthop.c | 7 ++++++ net/ipv4/tcp.c | 5 ++++ net/ipv4/tcp_input.c | 1 - net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- net/rfkill/rfkill-gpio.c | 4 ++-- net/sctp/diag.c | 21 ++++++++++++---- net/sctp/inqueue.c | 13 +++++----- net/sctp/ipv6.c | 2 ++ net/sctp/transport.c | 13 ++++++---- net/tipc/net.c | 2 ++ 16 files changed, 118 insertions(+), 60 deletions(-) -- 2.9.5

2 18

[PATCH OLK-6.6] pNFS: Fix a deadlock when returning a delegation during open()
by Li Lingfeng 06 Feb '26

06 Feb '26

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v6.19-rc6 commit 857bf9056291a16785ae3be1d291026b2437fc48 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13583 CVE: CVE-2026-23050 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] schedule at ffffffff9ca05717 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4] 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4] 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4] 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4] 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4] 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4] 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4] 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4] 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4] 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4] 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4] 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4] 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935 The issue is that the delegreturn is being asked to wait for a layout return that cannot complete because a state recovery was initiated. The state recovery cannot complete until the open() finishes processing the delegations it was given. The solution is to propagate the existing flags that indicate a non-blocking call to the function pnfs_roc(), so that it knows not to wait in this situation. Reported-by: Benjamin Coddington <bcodding(a)hammerspace.com> Fixes: 29ade5db1293 ("pNFS: Wait on outstanding layoutreturns to complete in pnfs_roc()") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/nfs/pnfs.c [Commit 5468fc8298a9 ("NFSv4/pNFS: Do layout state recovery upon reboot") add definition of pnfs_layout_return_on_reboot() before pnfs_roc().] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 6 ++--- fs/nfs/pnfs.c | 58 +++++++++++++++++++++++++++++++++-------------- fs/nfs/pnfs.h | 17 ++++++-------- 3 files changed, 51 insertions(+), 30 deletions(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 4410e2ad8f39..54ce1f41eb53 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -3783,8 +3783,8 @@ int nfs4_do_close(struct nfs4_state *state, gfp_t gfp_mask, int wait) calldata->res.seqid = calldata->arg.seqid; calldata->res.server = server; calldata->res.lr_ret = -NFS4ERR_NOMATCHING_LAYOUT; - calldata->lr.roc = pnfs_roc(state->inode, - &calldata->lr.arg, &calldata->lr.res, msg.rpc_cred); + calldata->lr.roc = pnfs_roc(state->inode, &calldata->lr.arg, + &calldata->lr.res, msg.rpc_cred, wait); if (calldata->lr.roc) { calldata->arg.lr_args = &calldata->lr.arg; calldata->res.lr_res = &calldata->lr.res; @@ -6729,7 +6729,7 @@ static int _nfs4_proc_delegreturn(struct inode *inode, const struct cred *cred, data->inode = nfs_igrab_and_active(inode); if (data->inode || issync) { data->lr.roc = pnfs_roc(inode, &data->lr.arg, &data->lr.res, - cred); + cred, issync); if (data->lr.roc) { data->args.lr_args = &data->lr.arg; data->res.lr_res = &data->lr.res; diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c index 0737d9a15d86..6dbfae295f76 100644 --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c @@ -1426,10 +1426,9 @@ pnfs_commit_and_return_layout(struct inode *inode) return ret; } -bool pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred) +bool pnfs_roc(struct inode *ino, struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, const struct cred *cred, + bool sync) { struct nfs_inode *nfsi = NFS_I(ino); struct nfs_open_context *ctx; @@ -1440,7 +1439,7 @@ bool pnfs_roc(struct inode *ino, nfs4_stateid stateid; enum pnfs_iomode iomode = 0; bool layoutreturn = false, roc = false; - bool skip_read = false; + bool skip_read; if (!nfs_have_layout(ino)) return false; @@ -1453,20 +1452,14 @@ bool pnfs_roc(struct inode *ino, lo = NULL; goto out_noroc; } - pnfs_get_layout_hdr(lo); - if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) { - spin_unlock(&ino->i_lock); - rcu_read_unlock(); - wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN, - TASK_UNINTERRUPTIBLE); - pnfs_put_layout_hdr(lo); - goto retry; - } /* no roc if we hold a delegation */ + skip_read = false; if (nfs4_check_delegation(ino, FMODE_READ)) { - if (nfs4_check_delegation(ino, FMODE_WRITE)) + if (nfs4_check_delegation(ino, FMODE_WRITE)) { + lo = NULL; goto out_noroc; + } skip_read = true; } @@ -1475,12 +1468,43 @@ bool pnfs_roc(struct inode *ino, if (state == NULL) continue; /* Don't return layout if there is open file state */ - if (state->state & FMODE_WRITE) + if (state->state & FMODE_WRITE) { + lo = NULL; goto out_noroc; + } if (state->state & FMODE_READ) skip_read = true; } + if (skip_read) { + bool writes = false; + + list_for_each_entry(lseg, &lo->plh_segs, pls_list) { + if (lseg->pls_range.iomode != IOMODE_READ) { + writes = true; + break; + } + } + if (!writes) { + lo = NULL; + goto out_noroc; + } + } + + pnfs_get_layout_hdr(lo); + if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) { + if (!sync) { + pnfs_set_plh_return_info( + lo, skip_read ? IOMODE_RW : IOMODE_ANY, 0); + goto out_noroc; + } + spin_unlock(&ino->i_lock); + rcu_read_unlock(); + wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN, + TASK_UNINTERRUPTIBLE); + pnfs_put_layout_hdr(lo); + goto retry; + } list_for_each_entry_safe(lseg, next, &lo->plh_segs, pls_list) { if (skip_read && lseg->pls_range.iomode == IOMODE_READ) @@ -1520,7 +1544,7 @@ bool pnfs_roc(struct inode *ino, out_noroc: spin_unlock(&ino->i_lock); rcu_read_unlock(); - pnfs_layoutcommit_inode(ino, true); + pnfs_layoutcommit_inode(ino, sync); if (roc) { struct pnfs_layoutdriver_type *ld = NFS_SERVER(ino)->pnfs_curr_ld; if (ld->prepare_layoutreturn) diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h index 79996d7dad0f..a613466f6f22 100644 --- a/fs/nfs/pnfs.h +++ b/fs/nfs/pnfs.h @@ -295,10 +295,9 @@ int pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo, u32 seq); int pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo, struct list_head *lseg_list); -bool pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred); +bool pnfs_roc(struct inode *ino, struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, const struct cred *cred, + bool sync); int pnfs_roc_done(struct rpc_task *task, struct nfs4_layoutreturn_args **argpp, struct nfs4_layoutreturn_res **respp, int *ret); void pnfs_roc_release(struct nfs4_layoutreturn_args *args, @@ -769,12 +768,10 @@ pnfs_layoutcommit_outstanding(struct inode *inode) return false; } - -static inline bool -pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred) +static inline bool pnfs_roc(struct inode *ino, + struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, + const struct cred *cred, bool sync) { return false; } -- 2.52.0

2 1

[PATCH OLK-6.6] Input: alps - fix use-after-free bugs caused by dev3_register_work
by Xia Fukun 06 Feb '26

06 Feb '26

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.19-rc2 commit bf40644ef8c8a288742fa45580897ed0e0289474 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13374 CVE: CVE-2025-68822 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis. Fixes: 04aae283ba6a ("Input: ALPS - do not mix trackstick and external PS/2 mouse data") Cc: stable(a)kernel.org Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://patch.msgid.link/b57b0a9ccca51a3f06be141bfc02b9ffe69d1845.176593939… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/input/mouse/alps.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c index e2c11d9f3868..4952fca027d9 100644 --- a/drivers/input/mouse/alps.c +++ b/drivers/input/mouse/alps.c @@ -2971,6 +2971,7 @@ static void alps_disconnect(struct psmouse *psmouse) psmouse_reset(psmouse); timer_shutdown_sync(&priv->timer); + disable_delayed_work_sync(&priv->dev3_register_work); if (priv->dev2) input_unregister_device(priv->dev2); if (!IS_ERR_OR_NULL(priv->dev3)) -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] CVE-2023-53712
by Liu Mingrui 06 Feb '26

06 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2023-53712 Mårten Lindahl (1): ARM: 9317/1: kexec: Make smp stop calls asynchronous arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH v2 OLK-6.6 0/3] Fix CVE-2025-22090
by Ze Zuo 06 Feb '26

06 Feb '26

Fix CVE-2025-22090. change since v1: - add fix patch for first patch. David Hildenbrand (3): x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() mm: (un)track_pfn_copy() fix + doc improvements kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 31 ++++++++++++++++++----- kernel/fork.c | 5 ++++ mm/memory.c | 11 +++------ 4 files changed, 62 insertions(+), 37 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS] media: av7110: prevent underflow in write_ts_to_decoder()
by Lin Ruifeng 06 Feb '26

06 Feb '26

From: Dan Carpenter <error27(a)gmail.com> stable inclusion from stable-v4.19.283 commit 6606e2404ee9e20a3ae5b42fc3660d41b739ed3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13080 CVE: CVE-2023-54284 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ] The buf[4] value comes from the user via ts_play(). It is a value in the u8 range. The final length we pass to av7110_ipack_instant_repack() is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is not negative. It's not clear that passing a negative len value does anything bad necessarily, but it's not best practice. With the new bounds checking the "if (!len)" condition is no longer possible or required so remove that. Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability") Signed-off-by: Dan Carpenter <error27(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/media/pci/ttpci/av7110_av.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c index ef1bc17cdc4d..03d1d1fba8bc 100644 --- a/drivers/media/pci/ttpci/av7110_av.c +++ b/drivers/media/pci/ttpci/av7110_av.c @@ -836,10 +836,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s av7110_ipack_flush(ipack); if (buf[3] & ADAPT_FIELD) { + if (buf[4] > len - 1 - 4) + return 0; len -= buf[4] + 1; buf += buf[4] + 1; - if (!len) - return 0; } av7110_ipack_instant_repack(buf + 4, len - 4, ipack); -- 2.43.0

2 1

[PATCH OLK-5.10] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v5.15.99 commit b4fe158259fb5fead52ff2b55841ec5c39492604 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8734 CVE: CVE-2023-53250 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 18e126e97c961f7a93823795c879d7c085fe5098 ] KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: <TASK> kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]--- It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del(). However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fix this. Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/firmware/dmi-sysfs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c index 4a93fb490cb4..3d57b08320df 100644 --- a/drivers/firmware/dmi-sysfs.c +++ b/drivers/firmware/dmi-sysfs.c @@ -600,20 +600,20 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, entry->kobj.kset = dmi_kset; *ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL, "%d-%d", dh->type, entry->instance); - if (*ret) { - kobject_put(&entry->kobj); - return; - } - /* Thread on the global list for cleanup */ spin_lock(&entry_list_lock); list_add_tail(&entry->list, &entry_list); spin_unlock(&entry_list_lock); + if (*ret) { + kobject_put(&entry->kobj); + return; + } + /* Handle specializations by type */ switch (dh->type) { case DMI_ENTRY_SYSTEM_EVENT_LOG: *ret = dmi_system_event_log(entry); break; -- 2.43.0

2 1

[PATCH OLK-5.10] mm/slub: avoid accessing metadata when pointer is invalid in object_err()
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Li Qiong <liqiong(a)nfschina.com> stable inclusion from stable-v5.10.243 commit f66012909e7bf383fcdc5850709ed5716073fdc4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8393 CVE: CVE-2025-39902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b4efccec8d06ceb10a7d34d7b1c449c569d53770 ] object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata. Fixes: 81819f0fc828 ("SLUB core") Cc: <stable(a)vger.kernel.org> Signed-off-by: Li Qiong <liqiong(a)nfschina.com> Reviewed-by: Harry Yoo <harry.yoo(a)oracle.com> Reviewed-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> [ struct page + print_page_info() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/slub.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index bcc00a95c368..88024a7ebeb0 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -751,11 +751,16 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p) void object_err(struct kmem_cache *s, struct page *page, u8 *object, char *reason) { slab_bug(s, "%s", reason); - print_trailer(s, page, object); + if (!object || !check_valid_pointer(s, page, object)) { + print_page_info(page); + pr_err("Invalid pointer 0x%p\n", object); + } else { + print_trailer(s, page, object); + } } static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page, const char *fmt, ...) { -- 2.43.0

2 1

[PATCH OLK-5.10] scsi: qla4xxx: Prevent a potential error pointer dereference
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.241 commit ad8a9d38d30c691a77c456e72b78f7932d4f234d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9005 CVE: CVE-2025-39676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9dcf111dd3e7ed5fce82bb108e3a3fc001c07225 ] The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL. Fixes: 13483730a13b ("[SCSI] qla4xxx: fix flash/ddb support") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/aJwnVKS9tHsw1tEu@stanley.mountain Reviewed-by: Chris Leech <cleech(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/qla4xxx/ql4_os.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index 15146e8be675..23bdd21ccc83 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -6614,10 +6614,12 @@ static struct iscsi_endpoint *qla4xxx_get_ep_fwdb(struct scsi_qla_host *ha, addr->sin_port = htons(le16_to_cpu(fw_ddb_entry->port)); } ep = qla4xxx_ep_connect(ha->host, (struct sockaddr *)dst_addr, 0); vfree(dst_addr); + if (IS_ERR(ep)) + return NULL; return ep; } static int qla4xxx_verify_boot_idx(struct scsi_qla_host *ha, uint16_t idx) { -- 2.43.0

2 1

[PATCH OLK-5.10] bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Andrii Nakryiko <andrii(a)kernel.org> stable inclusion from stable-v6.1.107 commit 40c88c429a598006f91ad7a2b89856cd50b3a008 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13001 CVE: CVE-2023-54145 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cff36398bd4c7d322d424433db437f3c3391c491 ] It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings. Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output. Reported-by: syzbot+8b2a08dfbd25fd933d75(a)syzkaller.appspotmail.com Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/r/20230516180409.3549088-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c kernel/bpf/log.c [Conflicts due to not merge 4294a0a7ab62 ("bpf: Split off basic BPF verifier log into separate file")] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- kernel/bpf/verifier.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 13849004ae38..fe05d95569d8 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -273,13 +273,10 @@ void bpf_verifier_vlog(struct bpf_verifier_log *log, const char *fmt, { unsigned int n; n = vscnprintf(log->kbuf, BPF_VERIFIER_TMP_LOG_SIZE, fmt, args); - WARN_ONCE(n >= BPF_VERIFIER_TMP_LOG_SIZE - 1, - "verifier log line truncated - local buffer too short\n"); - n = min(log->len_total - log->len_used - 1, n); log->kbuf[n] = '\0'; if (log->level == BPF_LOG_KERNEL) { pr_err("BPF:%s\n", log->kbuf); -- 2.43.0

2 1

[PATCH OLK-6.6] mm/vmalloc: fix data race in show_numa_info()
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit 5c5f0468d172ddec2e333d738d2a1f85402cf0bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9408 CVE: CVE-2025-38383 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following data-race was found in show_numa_info(): ================================================================== BUG: KCSAN: data-race in vmalloc_info_show / vmalloc_info_show read to 0xffff88800971fe30 of 4 bytes by task 8289 on cpu 0: show_numa_info mm/vmalloc.c:4936 [inline] vmalloc_info_show+0x5a8/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 .... write to 0xffff88800971fe30 of 4 bytes by task 8287 on cpu 1: show_numa_info mm/vmalloc.c:4934 [inline] vmalloc_info_show+0x38f/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 .... value changed: 0x0000008f -> 0x00000000 ================================================================== According to this report,there is a read/write data-race because m->private is accessible to multiple CPUs. To fix this, instead of allocating the heap in proc_vmalloc_init() and passing the heap address to m->private, vmalloc_info_show() should allocate the heap. Link: https://lkml.kernel.org/r/20250508165620.15321-1-aha310510@gmail.com Fixes: 8e1d743f2c26 ("mm: vmalloc: support multiple nodes in vmallocinfo") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Suggested-by: Eric Dumazet <edumazet(a)google.com> Suggested-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: "Uladzislau Rezki (Sony)" <urezki(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/vmalloc.c [conflicts due to merge 8e63c98d86f61 ("mm: vmalloc: support multiple nodes in vmallocinfo")] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/vmalloc.c | 63 +++++++++++++++++++++++++++++----------------------- 1 file changed, 35 insertions(+), 28 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 375b0782353f..1455393eec23 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -3094,11 +3094,11 @@ void __init vm_area_register_early(struct vm_struct *vm, size_t align) static void clear_vm_uninitialized_flag(struct vm_struct *vm) { /* * Before removing VM_UNINITIALIZED, * we should make sure that vm has proper values. - * Pair with smp_rmb() in show_numa_info(). + * Pair with smp_rmb() in vread_iter() and vmalloc_info_show(). */ smp_wmb(); vm->flags &= ~VM_UNINITIALIZED; } @@ -5049,32 +5049,33 @@ int remap_vmalloc_hugepage_range(struct vm_area_struct *vma, void *addr, } EXPORT_SYMBOL(remap_vmalloc_hugepage_range); #endif #ifdef CONFIG_PROC_FS -static void show_numa_info(struct seq_file *m, struct vm_struct *v) -{ - if (IS_ENABLED(CONFIG_NUMA)) { - unsigned int nr, *counters = m->private; - unsigned int step = 1U << vm_area_page_order(v); - if (!counters) - return; +/* + * Print number of pages allocated on each memory node. + * + * This function can only be called if CONFIG_NUMA is enabled + * and VM_UNINITIALIZED bit in v->flags is disabled. + */ +static void show_numa_info(struct seq_file *m, struct vm_struct *v, + unsigned int *counters) +{ + unsigned int nr; + unsigned int step = 1U << vm_area_page_order(v); - if (v->flags & VM_UNINITIALIZED) - return; - /* Pair with smp_wmb() in clear_vm_uninitialized_flag() */ - smp_rmb(); + if (!counters) + return; - memset(counters, 0, nr_node_ids * sizeof(unsigned int)); + memset(counters, 0, nr_node_ids * sizeof(unsigned int)); - for (nr = 0; nr < v->nr_pages; nr += step) - counters[page_to_nid(v->pages[nr])] += step; - for_each_node_state(nr, N_HIGH_MEMORY) - if (counters[nr]) - seq_printf(m, " N%u=%u", nr, counters[nr]); - } + for (nr = 0; nr < v->nr_pages; nr += step) + counters[page_to_nid(v->pages[nr])] += step; + for_each_node_state(nr, N_HIGH_MEMORY) + if (counters[nr]) + seq_printf(m, " N%u=%u", nr, counters[nr]); } static void show_purge_info(struct seq_file *m) { struct vmap_node *vn; @@ -5098,10 +5099,14 @@ static int vmalloc_info_show(struct seq_file *m, void *p) { struct vmap_node *vn; struct vmap_area *va; struct vm_struct *v; int i; + unsigned int *counters; + + if (IS_ENABLED(CONFIG_NUMA)) + counters = kmalloc(nr_node_ids * sizeof(unsigned int), GFP_KERNEL); for (i = 0; i < nr_vmap_nodes; i++) { vn = &vmap_nodes[i]; spin_lock(&vn->busy.lock); @@ -5114,10 +5119,15 @@ static int vmalloc_info_show(struct seq_file *m, void *p) continue; } v = va->vm; + if (v->flags & VM_UNINITIALIZED) + continue; + + /* Pair with smp_wmb() in clear_vm_uninitialized_flag() */ + smp_rmb(); seq_printf(m, "0x%pK-0x%pK %7ld", v->addr, v->addr + v->size, v->size); if (v->caller) @@ -5148,33 +5158,30 @@ static int vmalloc_info_show(struct seq_file *m, void *p) seq_puts(m, " dma-coherent"); if (is_vmalloc_addr(v->pages)) seq_puts(m, " vpages"); - show_numa_info(m, v); + if (IS_ENABLED(CONFIG_NUMA)) + show_numa_info(m, v, counters); + seq_putc(m, '\n'); } spin_unlock(&vn->busy.lock); } /* * As a final step, dump "unpurged" areas. */ show_purge_info(m); + if (IS_ENABLED(CONFIG_NUMA)) + kfree(counters); return 0; } static int __init proc_vmalloc_init(void) { - void *priv_data = NULL; - - if (IS_ENABLED(CONFIG_NUMA)) - priv_data = kmalloc(nr_node_ids * sizeof(unsigned int), GFP_KERNEL); - - proc_create_single_data("vmallocinfo", - 0400, NULL, vmalloc_info_show, priv_data); - + proc_create_single("vmallocinfo", 0400, NULL, vmalloc_info_show); return 0; } module_init(proc_vmalloc_init); #endif -- 2.43.0

2 1

[PATCH OLK-6.6] scsi: qla4xxx: Prevent a potential error pointer dereference
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.103 commit f5ad0819f902b4b33591791b92a0350fb3692a6b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9005 CVE: CVE-2025-39676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9dcf111dd3e7ed5fce82bb108e3a3fc001c07225 ] The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL. Fixes: 13483730a13b ("[SCSI] qla4xxx: fix flash/ddb support") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/aJwnVKS9tHsw1tEu@stanley.mountain Reviewed-by: Chris Leech <cleech(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/qla4xxx/ql4_os.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index 675332e49a7b..4cbeeaab63d7 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -6602,10 +6602,12 @@ static struct iscsi_endpoint *qla4xxx_get_ep_fwdb(struct scsi_qla_host *ha, addr->sin_port = htons(le16_to_cpu(fw_ddb_entry->port)); } ep = qla4xxx_ep_connect(ha->host, (struct sockaddr *)dst_addr, 0); vfree(dst_addr); + if (IS_ERR(ep)) + return NULL; return ep; } static int qla4xxx_verify_boot_idx(struct scsi_qla_host *ha, uint16_t idx) { -- 2.43.0

2 1

[PATCH OLK-6.6] mm/slub: avoid accessing metadata when pointer is invalid in object_err()
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Li Qiong <liqiong(a)nfschina.com> stable inclusion from stable-v6.6.105 commit 0ef7058b4dc6fcef622ac23b45225db57f17b83f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8393 CVE: CVE-2025-39902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b4efccec8d06ceb10a7d34d7b1c449c569d53770 ] object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata. Fixes: 81819f0fc828 ("SLUB core") Cc: <stable(a)vger.kernel.org> Signed-off-by: Li Qiong <liqiong(a)nfschina.com> Reviewed-by: Harry Yoo <harry.yoo(a)oracle.com> Reviewed-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> [ Adjust context ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/slub.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index 25516a5cbf04..fc1636d1be03 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1001,11 +1001,16 @@ static void object_err(struct kmem_cache *s, struct slab *slab, { if (slab_add_kunit_errors()) return; slab_bug(s, "%s", reason); - print_trailer(s, slab, object); + if (!object || !check_valid_pointer(s, slab, object)) { + print_slab_info(slab); + pr_err("Invalid pointer 0x%p\n", object); + } else { + print_trailer(s, slab, object); + } add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); } static bool freelist_corrupted(struct kmem_cache *s, struct slab *slab, void **freelist, void *nextfree) -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 06 Feb '26

06 Feb '26

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + include/linux/cpu.h | 1 + 12 files changed, 171 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> stable inclusion from stable-v6.6.117 commit 70150b9443dddf02157d821c68abf438f55a2e8e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11434 CVE: CVE-2025-40329 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 487df8b698345dd5a91346335f05170ed5f29d4e upstream. The Mesa issue referenced below pointed out a possible deadlock: [ 1231.611031] Possible interrupt unsafe locking scenario: [ 1231.611033] CPU0 CPU1 [ 1231.611034] ---- ---- [ 1231.611035] lock(&xa->xa_lock#17); [ 1231.611038] local_irq_disable(); [ 1231.611039] lock(&fence->lock); [ 1231.611041] lock(&xa->xa_lock#17); [ 1231.611044] <Interrupt> [ 1231.611045] lock(&fence->lock); [ 1231.611047] *** DEADLOCK *** In this example, CPU0 would be any function accessing job->dependencies through the xa_* functions that don't disable interrupts (eg: drm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()). CPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling callback so in an interrupt context. It will deadlock when trying to grab the xa_lock which is already held by CPU0. Replacing all xa_* usage by their xa_*_irq counterparts would fix this issue, but Christian pointed out another issue: dma_fence_signal takes fence.lock and so does dma_fence_add_callback. dma_fence_signal() // locks f1.lock -> drm_sched_entity_kill_jobs_cb() -> foreach dependencies -> dma_fence_add_callback() // locks f2.lock This will deadlock if f1 and f2 share the same spinlock. To fix both issues, the code iterating on dependencies and re-arming them is moved out to drm_sched_entity_kill_jobs_work(). Cc: stable(a)vger.kernel.org # v6.2+ Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") Link: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13908 Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Suggested-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> [phasta: commit message nits] Signed-off-by: Philipp Stanner <phasta(a)kernel.org> Link: https://patch.msgid.link/20251104095358.15092-1-pierre-eric.pelloux-prayer@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/gpu/drm/scheduler/sched_entity.c | 34 +++++++++++++----------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c index eed3b8bed9e4..01de4f072b68 100644 --- a/drivers/gpu/drm/scheduler/sched_entity.c +++ b/drivers/gpu/drm/scheduler/sched_entity.c @@ -161,30 +161,19 @@ int drm_sched_entity_error(struct drm_sched_entity *entity) return r; } EXPORT_SYMBOL(drm_sched_entity_error); +static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, + struct dma_fence_cb *cb); + static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk) { struct drm_sched_job *job = container_of(wrk, typeof(*job), work); - - drm_sched_fence_scheduled(job->s_fence, NULL); - drm_sched_fence_finished(job->s_fence, -ESRCH); - WARN_ON(job->s_fence->parent); - job->sched->ops->free_job(job); -} - -/* Signal the scheduler finished fence when the entity in question is killed. */ -static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, - struct dma_fence_cb *cb) -{ - struct drm_sched_job *job = container_of(cb, struct drm_sched_job, - finish_cb); + struct dma_fence *f; unsigned long index; - dma_fence_put(f); - /* Wait for all dependencies to avoid data corruptions */ xa_for_each(&job->dependencies, index, f) { struct drm_sched_fence *s_fence = to_drm_sched_fence(f); if (s_fence && f == &s_fence->scheduled) { @@ -208,10 +197,25 @@ static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, return; dma_fence_put(f); } + drm_sched_fence_scheduled(job->s_fence, NULL); + drm_sched_fence_finished(job->s_fence, -ESRCH); + WARN_ON(job->s_fence->parent); + job->sched->ops->free_job(job); +} + +/* Signal the scheduler finished fence when the entity in question is killed. */ +static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, + struct dma_fence_cb *cb) +{ + struct drm_sched_job *job = container_of(cb, struct drm_sched_job, + finish_cb); + + dma_fence_put(f); + INIT_WORK(&job->work, drm_sched_entity_kill_jobs_work); schedule_work(&job->work); } /* Remove the entity from the scheduler and kill all pending jobs */ -- 2.43.0

2 1

[PATCH OLK-6.6] parse_longname(): strrchr() expects NUL-terminated string
by Quanmin Yan 06 Feb '26

06 Feb '26

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v6.12.42 commit bb80f7618832d26f7e395f52f82b1dac76223e5f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9111 CVE: CVE-2025-38660 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 101841c38346f4ca41dc1802c867da990ffb32eb ] ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the entire thing and be done with that... Fixes: dd66df0053ef ("ceph: add support for encrypted snapshot names") Tested-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- fs/ceph/crypto.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-) diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c index 08c385610731..fa2aaf1d30f8 100644 --- a/fs/ceph/crypto.c +++ b/fs/ceph/crypto.c @@ -213,35 +213,31 @@ static struct inode *parse_longname(const struct inode *parent, { struct inode *dir = NULL; struct ceph_vino vino = { .snap = CEPH_NOSNAP }; - char *inode_number; - char *name_end; - int orig_len = *name_len; + char *name_end, *inode_number; int ret = -EIO; - + /* NUL-terminate */ + char *str __free(kfree) = kmemdup_nul(name, *name_len, GFP_KERNEL); + if (!str) + return ERR_PTR(-ENOMEM); /* Skip initial '_' */ - name++; - name_end = strrchr(name, '_'); + str++; + name_end = strrchr(str, '_'); if (!name_end) { - dout("Failed to parse long snapshot name: %s\n", name); + dout("Failed to parse long snapshot name: %s\n", str); return ERR_PTR(-EIO); } - *name_len = (name_end - name); + *name_len = (name_end - str); if (*name_len <= 0) { pr_err("Failed to parse long snapshot name\n"); return ERR_PTR(-EIO); } /* Get the inode number */ - inode_number = kmemdup_nul(name_end + 1, - orig_len - *name_len - 2, - GFP_KERNEL); - if (!inode_number) - return ERR_PTR(-ENOMEM); + inode_number = name_end + 1; ret = kstrtou64(inode_number, 10, &vino.ino); if (ret) { - dout("Failed to parse inode number: %s\n", name); - dir = ERR_PTR(ret); - goto out; + dout("Failed to parse inode number: %s\n", str); + return ERR_PTR(ret); } /* And finally the inode */ @@ -252,9 +248,6 @@ static struct inode *parse_longname(const struct inode *parent, if (IS_ERR(dir)) dout("Can't find inode %s (%s)\n", inode_number, name); } - -out: - kfree(inode_number); return dir; } -- 2.43.0

2 1

[PATCH OLK-6.6] media: imon: make send_packet() more robust
by Quanmin Yan 06 Feb '26

06 Feb '26

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.117 commit 8231e80118463be5598daaf266c1c83650f1948b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11614 CVE: CVE-2025-68194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ] syzbot is reporting that imon has three problems which result in hung tasks due to forever holding device lock [1]. First problem is that when usb_rx_callback_intf0() once got -EPROTO error after ictx->dev_present_intf0 became true, usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding (RCU stalls). Alan Stern commented [2] that In theory it's okay to resubmit _if_ the driver has a robust error-recovery scheme (such as giving up after some fixed limit on the number of errors or after some fixed time has elapsed, perhaps with a time delay to prevent a flood of errors). Most drivers don't bother to do this; they simply give up right away. This makes them more vulnerable to short-term noise interference during USB transfers, but in reality such interference is quite rare. There's nothing really wrong with giving up right away. but imon has a poor error-recovery scheme which just retries forever; this behavior should be fixed. Since I'm not sure whether it is safe for imon users to give up upon any error code, this patch takes care of only union of error codes chosen from modules in drivers/media/rc/ directory which handle -EPROTO error (i.e. ir_toy, mceusb and igorplugusb). Second problem is that when usb_rx_callback_intf0() once got -EPROTO error before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge hardware after early callbacks"). Move the ictx->dev_present_intf0 test introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes until intf configured") to immediately before imon_incoming_packet(), or the first problem explained above happens without printk() flooding (i.e. hung task). Third problem is that when usb_rx_callback_intf0() is not called for some reason (e.g. flaky hardware; the reproducer for this problem sometimes prevents usb_rx_callback_intf0() from being called), wait_for_completion_interruptible() in send_packet() never returns (i.e. hung task). As a workaround for such situation, change send_packet() to wait for completion with timeout of 10 seconds. Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1] Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harv… [2] Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 24 deletions(-) diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c index f4deca8894e0..bb4aabb08c06 100644 --- a/drivers/media/rc/imon.c +++ b/drivers/media/rc/imon.c @@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx) smp_rmb(); /* ensure later readers know we're not busy */ pr_err_ratelimited("error submitting urb(%d)\n", retval); } else { - /* Wait for transmission to complete (or abort) */ - retval = wait_for_completion_interruptible( - &ictx->tx.finished); - if (retval) { + /* Wait for transmission to complete (or abort or timeout) */ + retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ); + if (retval <= 0) { usb_kill_urb(ictx->tx_urb); pr_err_ratelimited("task interrupted\n"); + if (retval < 0) + ictx->tx.status = retval; + else + ictx->tx.status = -ETIMEDOUT; } ictx->tx.busy = false; @@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb) if (!ictx) return; - /* - * if we get a callback before we're done configuring the hardware, we - * can't yet process the data, as there's nowhere to send it, but we - * still need to submit a new rx URB to avoid wedging the hardware - */ - if (!ictx->dev_present_intf0) - goto out; - switch (urb->status) { case -ENOENT: /* usbcore unlink successful! */ return; @@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb) break; case 0: - imon_incoming_packet(ictx, urb, intfnum); + /* + * if we get a callback before we're done configuring the hardware, we + * can't yet process the data, as there's nowhere to send it, but we + * still need to submit a new rx URB to avoid wedging the hardware + */ + if (ictx->dev_present_intf0) + imon_incoming_packet(ictx, urb, intfnum); break; + case -ECONNRESET: + case -EILSEQ: + case -EPROTO: + case -EPIPE: + dev_warn(ictx->dev, "imon %s: status(%d)\n", + __func__, urb->status); + return; + default: dev_warn(ictx->dev, "imon %s: status(%d): ignored\n", __func__, urb->status); break; } -out: usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC); } @@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb) if (!ictx) return; - /* - * if we get a callback before we're done configuring the hardware, we - * can't yet process the data, as there's nowhere to send it, but we - * still need to submit a new rx URB to avoid wedging the hardware - */ - if (!ictx->dev_present_intf1) - goto out; - switch (urb->status) { case -ENOENT: /* usbcore unlink successful! */ return; @@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb) break; case 0: - imon_incoming_packet(ictx, urb, intfnum); + /* + * if we get a callback before we're done configuring the hardware, we + * can't yet process the data, as there's nowhere to send it, but we + * still need to submit a new rx URB to avoid wedging the hardware + */ + if (ictx->dev_present_intf1) + imon_incoming_packet(ictx, urb, intfnum); break; + case -ECONNRESET: + case -EILSEQ: + case -EPROTO: + case -EPIPE: + dev_warn(ictx->dev, "imon %s: status(%d)\n", + __func__, urb->status); + return; + default: dev_warn(ictx->dev, "imon %s: status(%d): ignored\n", __func__, urb->status); break; } -out: usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC); } -- 2.43.0

2 1

[PATCH OLK-6.6] ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
by Quanmin Yan 06 Feb '26

06 Feb '26

From: Pedro Demarchi Gomes <pedrodemargomes(a)gmail.com> stable inclusion from stable-v6.6.121 commit 9c2f8a9b68024e5ebb4813665845ec0a95f2eac3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11569 CVE: CVE-2025-68211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f5548c318d6520d4fa3c5ed6003eeb710763cbc5 upstream. Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1]. Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page: /* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024; int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0); if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; } /* Populate a single page such that we get an anon_vma. */ *area = 0; /* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; } $ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run Without this patch ksmd uses 100% of the cpu for a long time (more then 1 hour in my test machine) scanning all the 32 TiB virtual address space that contain only one mapped page. This makes ksmd essentially deadlocked not able to deduplicate anything of value. With this patch ksmd walks only the one mapped page and skips the rest of the 32 TiB virtual address space, making the scan fast using little cpu. Link: https://lkml.kernel.org/r/20251023035841.41406-1-pedrodemargomes@gmail.com Link: https://lkml.kernel.org/r/20251022153059.22763-1-pedrodemargomes@gmail.com Link: https://lore.kernel.org/linux-mm/423de7a3-1c62-4e72-8e79-19a6413e420c@redha… [1] Fixes: 31dbd01f3143 ("ksm: Kernel SamePage Merging") Signed-off-by: Pedro Demarchi Gomes <pedrodemargomes(a)gmail.com> Co-developed-by: David Hildenbrand <david(a)redhat.com> Signed-off-by: David Hildenbrand <david(a)redhat.com> Reported-by: craftfever <craftfever(a)airmail.cc> Closes: https://lkml.kernel.org/r/020cf8de6e773bb78ba7614ef250129f11a63781@murena.io Suggested-by: David Hildenbrand <david(a)redhat.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Chengming Zhou <chengming.zhou(a)linux.dev> Cc: xu xin <xu.xin16(a)zte.com.cn> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ change page to folios ] Signed-off-by: Pedro Demarchi Gomes <pedrodemargomes(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- mm/ksm.c | 126 +++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 113 insertions(+), 13 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index eca4c3078383..0cf19d0647b4 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -2310,6 +2310,95 @@ static struct ksm_rmap_item *get_next_rmap_item(struct ksm_mm_slot *mm_slot, return rmap_item; } +struct ksm_next_page_arg { + struct folio *folio; + struct page *page; + unsigned long addr; +}; + +static int ksm_next_page_pmd_entry(pmd_t *pmdp, unsigned long addr, unsigned long end, + struct mm_walk *walk) +{ + struct ksm_next_page_arg *private = walk->private; + struct vm_area_struct *vma = walk->vma; + pte_t *start_ptep = NULL, *ptep, pte; + struct mm_struct *mm = walk->mm; + struct folio *folio; + struct page *page; + spinlock_t *ptl; + pmd_t pmd; + + if (ksm_test_exit(mm)) + return 0; + + cond_resched(); + + pmd = pmdp_get_lockless(pmdp); + if (!pmd_present(pmd)) + return 0; + + if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && pmd_leaf(pmd)) { + ptl = pmd_lock(mm, pmdp); + pmd = pmdp_get(pmdp); + + if (!pmd_present(pmd)) { + goto not_found_unlock; + } else if (pmd_leaf(pmd)) { + page = vm_normal_page_pmd(vma, addr, pmd); + if (!page) + goto not_found_unlock; + folio = page_folio(page); + + if (folio_is_zone_device(folio) || !folio_test_anon(folio)) + goto not_found_unlock; + + page += ((addr & (PMD_SIZE - 1)) >> PAGE_SHIFT); + goto found_unlock; + } + spin_unlock(ptl); + } + + start_ptep = pte_offset_map_lock(mm, pmdp, addr, &ptl); + if (!start_ptep) + return 0; + + for (ptep = start_ptep; addr < end; ptep++, addr += PAGE_SIZE) { + pte = ptep_get(ptep); + + if (!pte_present(pte)) + continue; + + page = vm_normal_page(vma, addr, pte); + if (!page) + continue; + folio = page_folio(page); + + if (folio_is_zone_device(folio) || !folio_test_anon(folio)) + continue; + goto found_unlock; + } + +not_found_unlock: + spin_unlock(ptl); + if (start_ptep) + pte_unmap(start_ptep); + return 0; +found_unlock: + folio_get(folio); + spin_unlock(ptl); + if (start_ptep) + pte_unmap(start_ptep); + private->page = page; + private->folio = folio; + private->addr = addr; + return 1; +} + +static struct mm_walk_ops ksm_next_page_ops = { + .pmd_entry = ksm_next_page_pmd_entry, + .walk_lock = PGWALK_RDLOCK, +}; + static struct ksm_rmap_item *scan_get_next_rmap_item(struct page **page) { struct mm_struct *mm; @@ -2396,32 +2485,43 @@ static struct ksm_rmap_item *scan_get_next_rmap_item(struct page **page) ksm_scan.address = vma->vm_end; while (ksm_scan.address < vma->vm_end) { + struct ksm_next_page_arg ksm_next_page_arg; + struct page *tmp_page = NULL; + struct folio *folio; + if (ksm_test_exit(mm)) break; - *page = follow_page(vma, ksm_scan.address, FOLL_GET); - if (IS_ERR_OR_NULL(*page)) { - ksm_scan.address += PAGE_SIZE; - cond_resched(); - continue; + + int found; + + found = walk_page_range_vma(vma, ksm_scan.address, + vma->vm_end, + &ksm_next_page_ops, + &ksm_next_page_arg); + + if (found > 0) { + folio = ksm_next_page_arg.folio; + tmp_page = ksm_next_page_arg.page; + ksm_scan.address = ksm_next_page_arg.addr; + } else { + VM_WARN_ON_ONCE(found < 0); + ksm_scan.address = vma->vm_end - PAGE_SIZE; } - if (is_zone_device_page(*page)) - goto next_page; - if (PageAnon(*page)) { - flush_anon_page(vma, *page, ksm_scan.address); - flush_dcache_page(*page); + if (tmp_page) { + flush_anon_page(vma, tmp_page, ksm_scan.address); + flush_dcache_page(tmp_page); rmap_item = get_next_rmap_item(mm_slot, ksm_scan.rmap_list, ksm_scan.address); if (rmap_item) { ksm_scan.rmap_list = &rmap_item->rmap_list; ksm_scan.address += PAGE_SIZE; + *page = tmp_page; } else - put_page(*page); + folio_put(folio); mmap_read_unlock(mm); return rmap_item; } -next_page: - put_page(*page); ksm_scan.address += PAGE_SIZE; cond_resched(); } -- 2.43.0

2 1

[PATCH OLK-6.6] fbcon: Set fb_display[i]->mode to NULL when the mode is released
by Quanmin Yan 06 Feb '26

06 Feb '26

stable inclusion from stable-v6.6.117 commit 468f78276a37f4c6499385a4ce28f4f57be6655d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11306 CVE: CVE-2025-40323 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 upstream. Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: <TASK> dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps: 1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1; 2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP); 3. Switch console from fb to VGA (to allow normal rmmod of the ko); 4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[]; 5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0. Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL. Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> Reviewed-by: Thomas Zimmermann <tzimmermann(a)suse.de> Signed-off-by: Helge Deller <deller(a)gmx.de> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/video/fbdev/core/fbcon.c | 19 +++++++++++++++++++ drivers/video/fbdev/core/fbmem.c | 1 + include/linux/fbcon.h | 2 ++ 3 files changed, 22 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 9757276e8182..fc9df4accd47 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2825,6 +2825,25 @@ int fbcon_mode_deleted(struct fb_info *info, return found; } +static void fbcon_delete_mode(struct fb_videomode *m) +{ + struct fbcon_display *p; + + for (int i = first_fb_vc; i <= last_fb_vc; i++) { + p = &fb_display[i]; + if (p->mode == m) + p->mode = NULL; + } +} + +void fbcon_delete_modelist(struct list_head *head) +{ + struct fb_modelist *modelist; + + list_for_each_entry(modelist, head, list) + fbcon_delete_mode(&modelist->mode); +} + #ifdef CONFIG_VT_HW_CONSOLE_BINDING static void fbcon_unbind(void) { diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index 515a9ab711ec..aad127738272 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -1027,6 +1027,7 @@ static void do_unregister_framebuffer(struct fb_info *fb_info) fb_info->pixmap.addr = NULL; } + fbcon_delete_modelist(&fb_info->modelist); fb_destroy_modelist(&fb_info->modelist); registered_fb[fb_info->node] = NULL; num_registered_fb--; diff --git a/include/linux/fbcon.h b/include/linux/fbcon.h index 2382dec6d6ab..fb0fc2736b80 100644 --- a/include/linux/fbcon.h +++ b/include/linux/fbcon.h @@ -11,6 +11,7 @@ void fbcon_suspended(struct fb_info *info); void fbcon_resumed(struct fb_info *info); int fbcon_mode_deleted(struct fb_info *info, struct fb_videomode *mode); +void fbcon_delete_modelist(struct list_head *head); void fbcon_new_modelist(struct fb_info *info); void fbcon_get_requirement(struct fb_info *info, struct fb_blit_caps *caps); @@ -31,6 +32,7 @@ static inline void fbcon_suspended(struct fb_info *info) {} static inline void fbcon_resumed(struct fb_info *info) {} static inline int fbcon_mode_deleted(struct fb_info *info, struct fb_videomode *mode) { return 0; } +static inline void fbcon_delete_modelist(struct list_head *head) {} static inline void fbcon_new_modelist(struct fb_info *info) {} static inline void fbcon_get_requirement(struct fb_info *info, struct fb_blit_caps *caps) {} -- 2.43.0

2 1

[PATCH OLK-5.10 0/1] CVE-2025-39957
by Yongqiang Liu 06 Feb '26

06 Feb '26

Lachlan Hodges (1): wifi: mac80211: increase scan_ies_len for S1G net/mac80211/main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.43.0

2 2

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index d7a8f8bb9026..1c7e60b5a7cb 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1128,8 +1128,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-6.6] mtdchar: fix integer overflow in read/write ioctls
by Cui GaoSheng 06 Feb '26

06 Feb '26

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.118 commit 457376c6fbf0c69326a9bf1f72416225f681192b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11582 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e4185bed738da755b191aa3f2e16e8b48450e1b8 upstream. The "req.start" and "req.len" variables are u64 values that come from the user at the start of the function. We mask away the high 32 bits of "req.len" so that's capped at U32_MAX but the "req.start" variable can go up to U64_MAX which means that the addition can still integer overflow. Use check_add_overflow() to fix this bug. Fixes: 095bb6e44eb1 ("mtdchar: add MEMREAD ioctl") Fixes: 6420ac0af95d ("mtdchar: prevent unbounded allocation in MEMWRITE ioctl") Cc: stable(a)vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/mtd/mtdchar.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index 8dc4f5c493fc..335c702633ff 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -599,6 +599,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd, struct mtd_write_req __user *argp) uint8_t *datbuf = NULL, *oobbuf = NULL; size_t datbuf_len, oobbuf_len; int ret = 0; + u64 end; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -618,7 +619,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd, struct mtd_write_req __user *argp) req.len &= 0xffffffff; req.ooblen &= 0xffffffff; - if (req.start + req.len > mtd->size) + if (check_add_overflow(req.start, req.len, &end) || end > mtd->size) return -EINVAL; datbuf_len = min_t(size_t, req.len, mtd->erasesize); @@ -698,6 +699,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd, struct mtd_read_req __user *argp) size_t datbuf_len, oobbuf_len; size_t orig_len, orig_ooblen; int ret = 0; + u64 end; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -724,7 +726,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd, struct mtd_read_req __user *argp) req.len &= 0xffffffff; req.ooblen &= 0xffffffff; - if (req.start + req.len > mtd->size) { + if (check_add_overflow(req.start, req.len, &end) || end > mtd->size) { ret = -EINVAL; goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6] iio: common: st_sensors: Fix use of uninitialize device structs
by Wang Hai 05 Feb '26

05 Feb '26

From: Maud Spierings <maudspierings(a)gocontroll.com> mainline inclusion from mainline-v6.16-rc7 commit 9f92e93e257b33e73622640a9205f8642ec16ddd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9273 CVE: CVE-2025-38531 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Throughout the various probe functions &indio_dev->dev is used before it is initialized. This caused a kernel panic in st_sensors_power_enable() when the call to devm_regulator_bulk_get_enable() fails and then calls dev_err_probe() with the uninitialized device. This seems to only cause a panic with dev_err_probe(), dev_err(), dev_warn() and dev_info() don't seem to cause a panic, but are fixed as well. The issue is reported and traced here: [1] Link: https://lore.kernel.org/all/AM7P189MB100986A83D2F28AF3FFAF976E39EA@AM7P189M… [1] Cc: stable(a)vger.kernel.org Signed-off-by: Maud Spierings <maudspierings(a)gocontroll.com> Reviewed-by: Andy Shevchenko <andy(a)kernel.org> Link: https://... [1] Link: https://patch.msgid.link/20250527-st_iio_fix-v4-1-12d89801c761@gocontroll.c… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/common/st_sensors/st_sensors_core.c drivers/iio/common/st_sensors/st_sensors_trigger.c [just context conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/accel/st_accel_core.c | 10 +++--- .../iio/common/st_sensors/st_sensors_core.c | 36 +++++++++---------- .../common/st_sensors/st_sensors_trigger.c | 20 +++++------ 3 files changed, 31 insertions(+), 35 deletions(-) diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c index d2104e14e255..6c031accad86 100644 --- a/drivers/iio/accel/st_accel_core.c +++ b/drivers/iio/accel/st_accel_core.c @@ -1270,10 +1270,11 @@ static int apply_acpi_orientation(struct iio_dev *indio_dev) struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; struct acpi_device *adev; union acpi_object *ont; union acpi_object *elements; acpi_status status; + struct device *parent = indio_dev->dev.parent; int ret = -EINVAL; unsigned int val; int i, j; int final_ont[3][3] = { { 0 }, }; @@ -1288,21 +1289,20 @@ static int apply_acpi_orientation(struct iio_dev *indio_dev) { -1, 0, 0 }, { 0, 0, -1 }, }; - adev = ACPI_COMPANION(indio_dev->dev.parent); + adev = ACPI_COMPANION(parent); if (!adev) return -ENXIO; /* Read _ONT data, which should be a package of 6 integers. */ status = acpi_evaluate_object(adev->handle, "_ONT", NULL, &buffer); if (status == AE_NOT_FOUND) { return -ENXIO; } else if (ACPI_FAILURE(status)) { - dev_warn(&indio_dev->dev, "failed to execute _ONT: %d\n", - status); + dev_warn(parent, "failed to execute _ONT: %d\n", status); return status; } ont = buffer.pointer; if (ont->type != ACPI_TYPE_PACKAGE || ont->package.count != 6) @@ -1374,16 +1374,16 @@ static int apply_acpi_orientation(struct iio_dev *indio_dev) adata->mount_matrix.rotation[i * 3 + j] = str_value; } } ret = 0; - dev_info(&indio_dev->dev, "computed mount matrix from ACPI\n"); + dev_info(parent, "computed mount matrix from ACPI\n"); out: kfree(buffer.pointer); if (ret) - dev_dbg(&indio_dev->dev, + dev_dbg(parent, "failed to apply ACPI orientation data: %d\n", ret); return ret; } #else /* !CONFIG_ACPI */ diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c index c77d7bdcc121..dc2aeda4e472 100644 --- a/drivers/iio/common/st_sensors/st_sensors_core.c +++ b/drivers/iio/common/st_sensors/st_sensors_core.c @@ -152,11 +152,11 @@ static int st_sensors_set_fullscale(struct iio_dev *indio_dev, unsigned int fs) sdata->current_fullscale = &sdata->sensor_settings->fs.fs_avl[i]; return err; st_accel_set_fullscale_error: - dev_err(&indio_dev->dev, "failed to set new fullscale.\n"); + dev_err(indio_dev->dev.parent, "failed to set new fullscale.\n"); return err; } int st_sensors_set_enable(struct iio_dev *indio_dev, bool enable) { @@ -229,58 +229,56 @@ int st_sensors_power_enable(struct iio_dev *indio_dev) /* Regulators not mandatory, but if requested we should enable them. */ err = devm_regulator_bulk_get_enable(parent, ARRAY_SIZE(regulator_names), regulator_names); if (err) - return dev_err_probe(&indio_dev->dev, err, - "unable to enable supplies\n"); + return dev_err_probe(parent, err, "unable to enable supplies\n"); return 0; } EXPORT_SYMBOL_NS(st_sensors_power_enable, IIO_ST_SENSORS); static int st_sensors_set_drdy_int_pin(struct iio_dev *indio_dev, struct st_sensors_platform_data *pdata) { + struct device *parent = indio_dev->dev.parent; struct st_sensor_data *sdata = iio_priv(indio_dev); /* Sensor does not support interrupts */ if (!sdata->sensor_settings->drdy_irq.int1.addr && !sdata->sensor_settings->drdy_irq.int2.addr) { if (pdata->drdy_int_pin) - dev_info(&indio_dev->dev, + dev_info(parent, "DRDY on pin INT%d specified, but sensor does not support interrupts\n", pdata->drdy_int_pin); return 0; } switch (pdata->drdy_int_pin) { case 1: if (!sdata->sensor_settings->drdy_irq.int1.mask) { - dev_err(&indio_dev->dev, - "DRDY on INT1 not available.\n"); + dev_err(parent, "DRDY on INT1 not available.\n"); return -EINVAL; } sdata->drdy_int_pin = 1; break; case 2: if (!sdata->sensor_settings->drdy_irq.int2.mask) { - dev_err(&indio_dev->dev, - "DRDY on INT2 not available.\n"); + dev_err(parent, "DRDY on INT2 not available.\n"); return -EINVAL; } sdata->drdy_int_pin = 2; break; default: - dev_err(&indio_dev->dev, "DRDY on pdata not valid.\n"); + dev_err(parent, "DRDY on pdata not valid.\n"); return -EINVAL; } if (pdata->open_drain) { if (!sdata->sensor_settings->drdy_irq.int1.addr_od && !sdata->sensor_settings->drdy_irq.int2.addr_od) - dev_err(&indio_dev->dev, + dev_err(parent, "open drain requested but unsupported.\n"); else sdata->int_pin_open_drain = true; } @@ -334,18 +332,19 @@ void st_sensors_dev_name_probe(struct device *dev, char *name, int len) EXPORT_SYMBOL_NS(st_sensors_dev_name_probe, IIO_ST_SENSORS); int st_sensors_init_sensor(struct iio_dev *indio_dev, struct st_sensors_platform_data *pdata) { + struct device *parent = indio_dev->dev.parent; struct st_sensor_data *sdata = iio_priv(indio_dev); struct st_sensors_platform_data *of_pdata; int err = 0; mutex_init(&sdata->odr_lock); /* If OF/DT pdata exists, it will take precedence of anything else */ - of_pdata = st_sensors_dev_probe(indio_dev->dev.parent, pdata); + of_pdata = st_sensors_dev_probe(parent, pdata); if (IS_ERR(of_pdata)) return PTR_ERR(of_pdata); if (of_pdata) pdata = of_pdata; @@ -368,11 +367,11 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev, err = st_sensors_set_fullscale(indio_dev, sdata->current_fullscale->num); if (err < 0) return err; } else - dev_info(&indio_dev->dev, "Full-scale not possible\n"); + dev_info(parent, "Full-scale not possible\n"); err = st_sensors_set_odr(indio_dev, sdata->odr); if (err < 0) return err; @@ -403,11 +402,11 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev, } else { addr = sdata->sensor_settings->drdy_irq.int2.addr_od; mask = sdata->sensor_settings->drdy_irq.int2.mask_od; } - dev_info(&indio_dev->dev, + dev_info(parent, "set interrupt line to open drain mode on pin %d\n", sdata->drdy_int_pin); err = st_sensors_write_data_with_mask(indio_dev, addr, mask, 1); if (err < 0) @@ -592,25 +591,24 @@ EXPORT_SYMBOL_NS(st_sensors_get_settings_index, IIO_ST_SENSORS); * Return: 0 on success (valid sensor ID), else a negative error code. */ int st_sensors_verify_id(struct iio_dev *indio_dev) { struct st_sensor_data *sdata = iio_priv(indio_dev); + struct device *parent = indio_dev->dev.parent; int wai, err; if (sdata->sensor_settings->wai_addr) { err = regmap_read(sdata->regmap, sdata->sensor_settings->wai_addr, &wai); if (err < 0) { - dev_err(&indio_dev->dev, - "failed to read Who-Am-I register.\n"); - return err; + return dev_err_probe(parent, err, + "failed to read Who-Am-I register.\n"); } if (sdata->sensor_settings->wai != wai) { - dev_err(&indio_dev->dev, - "%s: WhoAmI mismatch (0x%x).\n", - indio_dev->name, wai); + dev_err(parent, "%s: WhoAmI mismatch (0x%x).\n", + indio_dev->name, wai); return -EINVAL; } } return 0; diff --git a/drivers/iio/common/st_sensors/st_sensors_trigger.c b/drivers/iio/common/st_sensors/st_sensors_trigger.c index a0df9250a69f..b900acd471bd 100644 --- a/drivers/iio/common/st_sensors/st_sensors_trigger.c +++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c @@ -125,11 +125,11 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, int err; sdata->trig = devm_iio_trigger_alloc(parent, "%s-trigger", indio_dev->name); if (sdata->trig == NULL) { - dev_err(&indio_dev->dev, "failed to allocate iio trigger.\n"); + dev_err(parent, "failed to allocate iio trigger.\n"); return -ENOMEM; } iio_trigger_set_drvdata(sdata->trig, indio_dev); sdata->trig->ops = trigger_ops; @@ -141,11 +141,11 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, */ switch(irq_trig) { case IRQF_TRIGGER_FALLING: case IRQF_TRIGGER_LOW: if (!sdata->sensor_settings->drdy_irq.addr_ihl) { - dev_err(&indio_dev->dev, + dev_err(parent, "falling/low specified for IRQ but hardware supports only rising/high: will request rising/high\n"); if (irq_trig == IRQF_TRIGGER_FALLING) irq_trig = IRQF_TRIGGER_RISING; if (irq_trig == IRQF_TRIGGER_LOW) irq_trig = IRQF_TRIGGER_HIGH; @@ -154,34 +154,32 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, err = st_sensors_write_data_with_mask(indio_dev, sdata->sensor_settings->drdy_irq.addr_ihl, sdata->sensor_settings->drdy_irq.mask_ihl, 1); if (err < 0) return err; - dev_info(&indio_dev->dev, + dev_info(parent, "interrupts on the falling edge or active low level\n"); } break; case IRQF_TRIGGER_RISING: - dev_info(&indio_dev->dev, - "interrupts on the rising edge\n"); + dev_info(parent, "interrupts on the rising edge\n"); break; case IRQF_TRIGGER_HIGH: - dev_info(&indio_dev->dev, - "interrupts active high level\n"); + dev_info(parent, "interrupts active high level\n"); break; default: /* This is the most preferred mode, if possible */ - dev_err(&indio_dev->dev, + dev_err(parent, "unsupported IRQ trigger specified (%lx), enforce rising edge\n", irq_trig); irq_trig = IRQF_TRIGGER_RISING; } /* Tell the interrupt handler that we're dealing with edges */ if (irq_trig == IRQF_TRIGGER_FALLING || irq_trig == IRQF_TRIGGER_RISING) { if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr) { - dev_err(&indio_dev->dev, + dev_err(parent, "edge IRQ not supported w/o stat register.\n"); return -EOPNOTSUPP; } sdata->edge_irq = true; } else { @@ -212,17 +210,17 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, st_sensors_irq_thread, irq_trig, sdata->trig->name, sdata->trig); if (err) { - dev_err(&indio_dev->dev, "failed to request trigger IRQ.\n"); + dev_err(parent, "failed to request trigger IRQ.\n"); return err; } err = devm_iio_trigger_register(parent, sdata->trig); if (err < 0) { - dev_err(&indio_dev->dev, "failed to register iio trigger.\n"); + dev_err(parent, "failed to register iio trigger.\n"); return err; } indio_dev->trig = iio_trigger_get(sdata->trig); return 0; -- 2.17.1

2 1

[PATCH OLK-5.10] ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Will Rosenberg <whrosenb(a)asu.edu> stable inclusion from stable-v5.10.248 commit 86f365897068d09418488165a68b23cb5baa37f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13396 CVE: CVE-2025-71085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 58fc7342b529803d3c221101102fe913df7adb83 ] There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of the calipso_skbuff_setattr() routine when skb_cow() is passed headroom > INT_MAX (i.e. (int)(skb_headroom(skb) + len_delta) < 0). The root cause of the bug is due to an implicit integer cast in __skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure that delta = headroom - skb_headroom(skb) is never negative, otherwise we will trigger a BUG_ON in pskb_expand_head(). However, if headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta becomes negative, and pskb_expand_head() is passed a negative value for nhead. Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing "negative" headroom sizes to skb_cow() within calipso_skbuff_setattr() by only using skb_cow() to grow headroom. PoC: Using `netlabelctl` tool: netlabelctl map del default netlabelctl calipso add pass doi:7 netlabelctl map add default address:0::1/128 protocol:calipso,7 Then run the following PoC: int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP); // setup msghdr int cmsg_size = 2; int cmsg_len = 0x60; struct msghdr msg; struct sockaddr_in6 dest_addr; struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len); msg.msg_name = &dest_addr; msg.msg_namelen = sizeof(dest_addr); msg.msg_iov = NULL; msg.msg_iovlen = 0; msg.msg_control = cmsg; msg.msg_controllen = cmsg_len; msg.msg_flags = 0; // setup sockaddr dest_addr.sin6_family = AF_INET6; dest_addr.sin6_port = htons(31337); dest_addr.sin6_flowinfo = htonl(31337); dest_addr.sin6_addr = in6addr_loopback; dest_addr.sin6_scope_id = 31337; // setup cmsghdr cmsg->cmsg_len = cmsg_len; cmsg->cmsg_level = IPPROTO_IPV6; cmsg->cmsg_type = IPV6_HOPOPTS; char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr); hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80 sendmsg(fd, &msg, 0); Fixes: 2917f57b6bc1 ("calipso: Allow the lsm to label the skbuff directly.") Suggested-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Will Rosenberg <whrosenb(a)asu.edu> Acked-by: Paul Moore <paul(a)paul-moore.com> Link: https://patch.msgid.link/20251219173637.797418-1-whrosenb@asu.edu Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- net/ipv6/calipso.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c index b24afbf3dbe4..23304346b537 100644 --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -1330,7 +1330,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, /* At this point new_end aligns to 4n, so (new_end & 4) pads to 8n */ pad = ((new_end & 4) + (end & 7)) & 7; len_delta = new_end - (int)end + pad; - ret_val = skb_cow(skb, skb_headroom(skb) + len_delta); + ret_val = skb_cow(skb, + skb_headroom(skb) + (len_delta > 0 ? len_delta : 0)); if (ret_val < 0) return ret_val; -- 2.25.1

2 1

[PATCH OLK-5.10] net/sched: sch_qfq: do not free existing class in qfq_change_class()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13510 CVE: CVE-2026-22999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: syzbot+07f3f38f723c335f106d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6965351d.050a0220.eaf7.00c5.GAE@google.com/T… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://patch.msgid.link/20260112175656.17605-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_qfq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index e90cbc47414c..e24b88869e52 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -532,8 +532,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, return 0; destroy_class: - qdisc_put(cl->qdisc); - kfree(cl); + if (!existing) { + qdisc_put(cl->qdisc); + kfree(cl); + } return err; } -- 2.25.1

2 1

[PATCH OLK-5.10 v2] macvlan: fix possible UAF in macvlan_forward_source()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13512 CVE: CVE-2026-23001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts. This allows macvlan_forward_source() to skip over entries queued for freeing. Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)). Fixes: 79cf79abce71 ("macvlan: add source mode") Reported-by: syzbot+7182fbe91e58602ec1fe(a)syzkaller.appspotmail.com https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE(a)google.com/T/#u Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/macvlan.c [commit bb23ffa1015c is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/macvlan.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index 9c77e6ab2b30..2ed99251d5e0 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -55,7 +55,7 @@ struct macvlan_port { struct macvlan_source_entry { struct hlist_node hlist; - struct macvlan_dev *vlan; + struct macvlan_dev __rcu *vlan; unsigned char addr[6+2] __aligned(sizeof(u16)); struct rcu_head rcu; }; @@ -141,7 +141,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source( hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { if (ether_addr_equal_64bits(entry->addr, addr) && - entry->vlan == vlan) + rcu_access_pointer(entry->vlan) == vlan) return entry; } return NULL; @@ -163,7 +163,7 @@ static int macvlan_hash_add_source(struct macvlan_dev *vlan, return -ENOMEM; ether_addr_copy(entry->addr, addr); - entry->vlan = vlan; + RCU_INIT_POINTER(entry->vlan, vlan); h = &port->vlan_source_hash[macvlan_eth_hash(addr)]; hlist_add_head_rcu(&entry->hlist, h); vlan->macaddr_count++; @@ -182,6 +182,7 @@ static void macvlan_hash_add(struct macvlan_dev *vlan) static void macvlan_hash_del_source(struct macvlan_source_entry *entry) { + RCU_INIT_POINTER(entry->vlan, NULL); hlist_del_rcu(&entry->hlist); kfree_rcu(entry, rcu); } @@ -388,7 +389,7 @@ static void macvlan_flush_sources(struct macvlan_port *port, entry = hlist_entry(h, struct macvlan_source_entry, hlist); - if (entry->vlan == vlan) + if (rcu_access_pointer(entry->vlan) == vlan) macvlan_hash_del_source(entry); } } @@ -430,8 +431,13 @@ static void macvlan_forward_source(struct sk_buff *skb, struct hlist_head *h = &port->vlan_source_hash[idx]; hlist_for_each_entry_rcu(entry, h, hlist) { - if (ether_addr_equal_64bits(entry->addr, addr)) - macvlan_forward_source_one(skb, entry->vlan); + if (ether_addr_equal_64bits(entry->addr, addr)) { + struct macvlan_dev *vlan = rcu_dereference(entry->vlan); + + if (!vlan) + continue; + macvlan_forward_source_one(skb, vlan); + } } } @@ -1615,7 +1621,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb, struct macvlan_source_entry *entry; hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { - if (entry->vlan != vlan) + if (rcu_access_pointer(entry->vlan) != vlan) continue; if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr)) return 1; -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] fix CVE-2025-68231
by Qi Xi 05 Feb '26

05 Feb '26

Fabio M. De Francesco (2): mm/mempool: replace kmap_atomic() with kmap_local_page() mm/page_poison: replace kmap_atomic() with kmap_local_page() Vlastimil Babka (1): mm/mempool: fix poisoning order>0 pages with HIGHMEM mm/mempool.c | 35 +++++++++++++++++++++++++++++------ mm/page_poison.c | 8 ++++---- 2 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6] usb: gadget: udc: fix use-after-free in usb_gadget_state_work
by Qi Xi 05 Feb '26

05 Feb '26

From: Jimmy Hu <hhhuuu(a)google.com> mainline inclusion from mainline-v6.18 commit baeb66fbd4201d1c4325074e78b1f557dff89b5b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11530 CVE: CVE-2025-68282 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window. Fixes: 5702f75375aa9 ("usb: gadget: udc-core: move sysfs_notify() to a workqueue") Cc: stable <stable(a)kernel.org> Signed-off-by: Jimmy Hu <hhhuuu(a)google.com> Link: https://patch.msgid.link/20251023054945.233861-1-hhhuuu@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/gadget/udc/core.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 17 ++++++++++++++++- include/linux/usb/gadget.h | 5 +++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index a4120a25428e..00362ec876a4 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -1118,8 +1118,13 @@ static void usb_gadget_state_work(struct work_struct *work) void usb_gadget_set_state(struct usb_gadget *gadget, enum usb_device_state state) { + unsigned long flags; + + spin_lock_irqsave(&gadget->state_lock, flags); gadget->state = state; - schedule_work(&gadget->work); + if (!gadget->teardown) + schedule_work(&gadget->work); + spin_unlock_irqrestore(&gadget->state_lock, flags); } EXPORT_SYMBOL_GPL(usb_gadget_set_state); @@ -1352,6 +1357,8 @@ static void usb_udc_nop_release(struct device *dev) void usb_initialize_gadget(struct device *parent, struct usb_gadget *gadget, void (*release)(struct device *dev)) { + spin_lock_init(&gadget->state_lock); + gadget->teardown = false; INIT_WORK(&gadget->work, usb_gadget_state_work); gadget->dev.parent = parent; @@ -1526,6 +1533,7 @@ EXPORT_SYMBOL_GPL(usb_add_gadget_udc); void usb_del_gadget(struct usb_gadget *gadget) { struct usb_udc *udc = gadget->udc; + unsigned long flags; if (!udc) return; @@ -1539,6 +1547,13 @@ void usb_del_gadget(struct usb_gadget *gadget) kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE); sysfs_remove_link(&udc->dev.kobj, "gadget"); device_del(&gadget->dev); + /* + * Set the teardown flag before flushing the work to prevent new work + * from being scheduled while we are cleaning up. + */ + spin_lock_irqsave(&gadget->state_lock, flags); + gadget->teardown = true; + spin_unlock_irqrestore(&gadget->state_lock, flags); flush_work(&gadget->work); ida_free(&gadget_id_numbers, gadget->id_number); cancel_work_sync(&udc->vbus_work); diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h index 75bda0783395..2548ccf72222 100644 --- a/include/linux/usb/gadget.h +++ b/include/linux/usb/gadget.h @@ -349,6 +349,9 @@ struct usb_gadget_ops { * can handle. The UDC must support this and all slower speeds and lower * number of lanes. * @state: the state we are now (attached, suspended, configured, etc) + * @state_lock: Spinlock protecting the `state` and `teardown` members. + * @teardown: True if the device is undergoing teardown, used to prevent + * new work from being scheduled during cleanup. * @name: Identifies the controller hardware type. Used in diagnostics * and sometimes configuration. * @dev: Driver model state for this abstract device. @@ -424,6 +427,8 @@ struct usb_gadget { enum usb_ssp_rate max_ssp_rate; enum usb_device_state state; + spinlock_t state_lock; + bool teardown; const char *name; struct device dev; unsigned isoch_delay; -- 2.33.0

2 1

[PATCH OLK-6.6] net: dsa: properly keep track of conduit reference
by Qi Xi 05 Feb '26

05 Feb '26

From: Vladimir Oltean <vladimir.oltean(a)nxp.com> mainline inclusion from mainline-v6.19-rc4 commit 06e219f6a706c367c93051f408ac61417643d2f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13476 CVE: CVE-2025-71152 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Problem description ------------------- DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense. There are two distinct problems. 1. The OF path, which uses of_find_net_device_by_node(), never releases the elevated refcount on the conduit's kobject. Nominally, the OF and non-OF paths should result in objects having identical reference counts taken, and it is already suspicious that dsa_dev_to_net_device() has a put_device() call which is missing in dsa_port_parse_of(), but we can actually even verify that an issue exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command "before" and "after" applying this patch: (unbind the conduit driver for net device eno2) echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind we see these lines in the output diff which appear only with the patch applied: kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000) kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000) 2. After we find the conduit interface one way (OF) or another (non-OF), it can get unregistered at any time, and DSA remains with a long-lived, but in this case stale, cpu_dp->conduit pointer. Holding the net device's underlying kobject isn't actually of much help, it just prevents it from being freed (but we never need that kobject directly). What helps us to prevent the net device from being unregistered is the parallel netdev reference mechanism (dev_hold() and dev_put()). Actually we actually use that netdev tracker mechanism implicitly on user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link(). But time still passes at DSA switch probe time between the initial of_find_net_device_by_node() code and the user port creation time, time during which the conduit could unregister itself and DSA wouldn't know about it. So we have to run of_find_net_device_by_node() under rtnl_lock() to prevent that from happening, and release the lock only with the netdev tracker having acquired the reference. Do we need to keep the reference until dsa_unregister_switch() / dsa_switch_shutdown()? 1: Maybe yes. A switch device will still be registered even if all user ports failed to probe, see commit 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal"), and the cpu_dp->conduit pointers remain valid. I haven't audited all call paths to see whether they will actually use the conduit in lack of any user port, but if they do, it seems safer to not rely on user ports for that reference. 2. Definitely yes. We support changing the conduit which a user port is associated to, and we can get into a situation where we've moved all user ports away from a conduit, thus no longer hold any reference to it via the net device tracker. But we shouldn't let it go nonetheless - see the next change in relation to dsa_tree_find_first_conduit() and LAG conduits which disappear. We have to be prepared to return to the physical conduit, so the CPU port must explicitly keep another reference to it. This is also to say: the user ports and their CPU ports may not always keep a reference to the same conduit net device, and both are needed. As for the conduit's kobject for the /sys/class/net/ entry, we don't care about it, we can release it as soon as we hold the net device object itself. History and blame attribution ----------------------------- The code has been refactored so many times, it is very difficult to follow and properly attribute a blame, but I'll try to make a short history which I hope to be correct. We have two distinct probing paths: - one for OF, introduced in 2016 in commit 83c0afaec7b7 ("net: dsa: Add new binding implementation") - one for non-OF, introduced in 2017 in commit 71e0bbde0d88 ("net: dsa: Add support for platform data") These are both complete rewrites of the original probing paths (which used struct dsa_switch_driver and other weird stuff, instead of regular devices on their respective buses for register access, like MDIO, SPI, I2C etc): - one for OF, introduced in 2013 in commit 5e95329b701c ("dsa: add device tree bindings to register DSA switches") - one for non-OF, introduced in 2008 in commit 91da11f870f0 ("net: Distributed Switch Architecture protocol support") except for tiny bits and pieces like dsa_dev_to_net_device() which were seemingly carried over since the original commit, and used to this day. The point is that the original probing paths received a fix in 2015 in the form of commit 679fb46c5785 ("net: dsa: Add missing master netdev dev_put() calls"), but the fix never made it into the "new" (dsa2) probing paths that can still be traced to today, and the fixed probing path was later deleted in 2019 in commit 93e86b3bc842 ("net: dsa: Remove legacy probing support"). That is to say, the new probing paths were never quite correct in this area. The existence of the legacy probing support which was deleted in 2019 explains why dsa_dev_to_net_device() returns a conduit with elevated refcount (because it was supposed to be released during dsa_remove_dst()). After the removal of the legacy code, the only user of dsa_dev_to_net_device() calls dev_put(conduit) immediately after this function returns. This pattern makes no sense today, and can only be interpreted historically to understand why dev_hold() was there in the first place. Change details -------------- Today we have a better netdev tracking infrastructure which we should use. Logically netdev_hold() belongs in common code (dsa_port_parse_cpu(), where dp->conduit is assigned), but there is a tradeoff to be made with the rtnl_lock() section which would become a bit too long if we did that - dsa_port_parse_cpu() also calls request_module(). So we duplicate a bit of logic in order for the callers of dsa_port_parse_cpu() to be the ones responsible of holding the conduit reference and releasing it on error. This shortens the rtnl_lock() section significantly. In the dsa_switch_probe() error path, dsa_switch_release_ports() will be called in a number of situations, one being where dsa_port_parse_cpu() maybe didn't get the chance to run at all (a different port failed earlier, etc). So we have to test for the conduit being NULL prior to calling netdev_put(). There have still been so many transformations to the code since the blamed commits (rename master -> conduit, commit 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown")), that it only makes sense to fix the code using the best methods available today and see how it can be backported to stable later. I suspect the fix cannot even be backported to kernels which lack dsa_switch_shutdown(), and I suspect this is also maybe why the long-lived conduit reference didn't make it into the new DSA probing paths at the time (problems during shutdown). Because dsa_dev_to_net_device() has a single call site and has to be changed anyway, the logic was just absorbed into the non-OF dsa_port_parse(). Tested on the ocelot/felix switch and on dsa_loop, both on the NXP LS1028A with CONFIG_DEBUG_KOBJECT_RELEASE=y. Reported-by: Ma Ke <make24(a)iscas.ac.cn> Closes: https://lore.kernel.org/netdev/20251214131204.4684-1-make24@iscas.ac.cn/ Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation") Fixes: 71e0bbde0d88 ("net: dsa: Add support for platform data") Reviewed-by: Jonas Gorski <jonas.gorski(a)gmail.com> Signed-off-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Link: https://patch.msgid.link/20251215150236.3931670-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/dsa/dsa.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/net/dsa.h | 1 + net/dsa/dsa.c | 59 +++++++++++++++++++++++++++-------------------- 2 files changed, 35 insertions(+), 25 deletions(-) diff --git a/include/net/dsa.h b/include/net/dsa.h index 0b9c6aa27047..3b9cb8e7e25f 100644 --- a/include/net/dsa.h +++ b/include/net/dsa.h @@ -297,6 +297,7 @@ struct dsa_port { struct devlink_port devlink_port; struct phylink *pl; struct phylink_config pl_config; + netdevice_tracker conduit_tracker; struct dsa_lag *lag; struct net_device *hsr_dev; diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c index c9bf1a9a6c99..291efcaf75ab 100644 --- a/net/dsa/dsa.c +++ b/net/dsa/dsa.c @@ -1257,14 +1257,25 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) if (ethernet) { struct net_device *master; const char *user_protocol; + int err; + rtnl_lock(); master = of_find_net_device_by_node(ethernet); of_node_put(ethernet); - if (!master) + if (!master) { + rtnl_unlock(); return -EPROBE_DEFER; + } + + netdev_hold(master, &dp->conduit_tracker, GFP_KERNEL); + put_device(&master->dev); + rtnl_unlock(); user_protocol = of_get_property(dn, "dsa-tag-protocol", NULL); - return dsa_port_parse_cpu(dp, master, user_protocol); + err = dsa_port_parse_cpu(dp, master, user_protocol); + if (err) + netdev_put(master, &dp->conduit_tracker); + return err; } if (link) @@ -1397,37 +1408,30 @@ static struct device *dev_find_class(struct device *parent, char *class) return device_find_child(parent, class, dev_is_class); } -static struct net_device *dsa_dev_to_net_device(struct device *dev) -{ - struct device *d; - - d = dev_find_class(dev, "net"); - if (d != NULL) { - struct net_device *nd; - - nd = to_net_dev(d); - dev_hold(nd); - put_device(d); - - return nd; - } - - return NULL; -} - static int dsa_port_parse(struct dsa_port *dp, const char *name, struct device *dev) { if (!strcmp(name, "cpu")) { struct net_device *master; + struct device *d; + int err; - master = dsa_dev_to_net_device(dev); - if (!master) + rtnl_lock(); + d = dev_find_class(dev, "net"); + if (!d) { + rtnl_unlock(); return -EPROBE_DEFER; + } - dev_put(master); + master = to_net_dev(d); + netdev_hold(master, &dp->conduit_tracker, GFP_KERNEL); + put_device(d); + rtnl_unlock(); - return dsa_port_parse_cpu(dp, master, NULL); + err = dsa_port_parse_cpu(dp, master, NULL); + if (err) + netdev_put(master, &dp->conduit_tracker); + return err; } if (!strcmp(name, "dsa")) @@ -1495,6 +1499,9 @@ static void dsa_switch_release_ports(struct dsa_switch *ds) struct dsa_vlan *v, *n; dsa_switch_for_each_port_safe(dp, next, ds) { + if (dsa_port_is_cpu(dp) && dp->master) + netdev_put(dp->master, &dp->conduit_tracker); + /* These are either entries that upper layers lost track of * (probably due to bugs), or installed through interfaces * where one does not necessarily have to remove them, like @@ -1639,8 +1646,10 @@ void dsa_switch_shutdown(struct dsa_switch *ds) /* Disconnect from further netdevice notifiers on the master, * since netdev_uses_dsa() will now return false. */ - dsa_switch_for_each_cpu_port(dp, ds) + dsa_switch_for_each_cpu_port(dp, ds) { dp->master->dsa_ptr = NULL; + netdev_put(dp->master, &dp->conduit_tracker); + } rtnl_unlock(); out: -- 2.33.0

2 1

[PATCH OLK-6.6] net/sched: sch_qfq: do not free existing class in qfq_change_class()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13510 CVE: CVE-2026-22999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: syzbot+07f3f38f723c335f106d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6965351d.050a0220.eaf7.00c5.GAE@google.com/T… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://patch.msgid.link/20260112175656.17605-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_qfq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index 2e91207dabf0..59d21b5e8ad1 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -532,8 +532,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, return 0; destroy_class: - qdisc_put(cl->qdisc); - kfree(cl); + if (!existing) { + qdisc_put(cl->qdisc); + kfree(cl); + } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6] macvlan: fix possible UAF in macvlan_forward_source()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13512 CVE: CVE-2026-23001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts. This allows macvlan_forward_source() to skip over entries queued for freeing. Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)). Fixes: 79cf79abce71 ("macvlan: add source mode") Reported-by: syzbot+7182fbe91e58602ec1fe(a)syzkaller.appspotmail.com https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE(a)google.com/T/#u Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/macvlan.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index c8da94af4161..09db43ce3176 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -58,7 +58,7 @@ struct macvlan_port { struct macvlan_source_entry { struct hlist_node hlist; - struct macvlan_dev *vlan; + struct macvlan_dev __rcu *vlan; unsigned char addr[6+2] __aligned(sizeof(u16)); struct rcu_head rcu; }; @@ -145,7 +145,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source( hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { if (ether_addr_equal_64bits(entry->addr, addr) && - entry->vlan == vlan) + rcu_access_pointer(entry->vlan) == vlan) return entry; } return NULL; @@ -167,7 +167,7 @@ static int macvlan_hash_add_source(struct macvlan_dev *vlan, return -ENOMEM; ether_addr_copy(entry->addr, addr); - entry->vlan = vlan; + RCU_INIT_POINTER(entry->vlan, vlan); h = &port->vlan_source_hash[macvlan_eth_hash(addr)]; hlist_add_head_rcu(&entry->hlist, h); vlan->macaddr_count++; @@ -186,6 +186,7 @@ static void macvlan_hash_add(struct macvlan_dev *vlan) static void macvlan_hash_del_source(struct macvlan_source_entry *entry) { + RCU_INIT_POINTER(entry->vlan, NULL); hlist_del_rcu(&entry->hlist); kfree_rcu(entry, rcu); } @@ -389,7 +390,7 @@ static void macvlan_flush_sources(struct macvlan_port *port, int i; hash_for_each_safe(port->vlan_source_hash, i, next, entry, hlist) - if (entry->vlan == vlan) + if (rcu_access_pointer(entry->vlan) == vlan) macvlan_hash_del_source(entry); vlan->macaddr_count = 0; @@ -432,9 +433,14 @@ static bool macvlan_forward_source(struct sk_buff *skb, hlist_for_each_entry_rcu(entry, h, hlist) { if (ether_addr_equal_64bits(entry->addr, addr)) { - if (entry->vlan->flags & MACVLAN_FLAG_NODST) + struct macvlan_dev *vlan = rcu_dereference(entry->vlan); + + if (!vlan) + continue; + + if (vlan->flags & MACVLAN_FLAG_NODST) consume = true; - macvlan_forward_source_one(skb, entry->vlan); + macvlan_forward_source_one(skb, vlan); } } @@ -1685,7 +1691,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb, struct macvlan_source_entry *entry; hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { - if (entry->vlan != vlan) + if (rcu_access_pointer(entry->vlan) != vlan) continue; if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr)) return 1; -- 2.25.1

2 1

[PATCH OLK-6.6 00/11] net: LTS-6.6 bugfix backport
by Dong Chenchen 05 Feb '26

05 Feb '26

net LTS-6.6 patches backport Dong Chenchen (1): Revert "netfilter: nft_objref: validate objref and objrefmap expressions" Eric Dumazet (2): ip6_gre: make ip6gre_header() robust arp: do not assume dev_hard_header() does not change skb->head Fernando Fernandez Mancera (1): netfilter: nft_objref: validate objref and objrefmap expressions Florian Westphal (2): netfilter: nf_tables: drop unused 3rd argument from validate callback ops netfilter: nf_tables: avoid chain re-validation if possible Gal Pressman (1): ethtool: Avoid overflowing userspace buffer on stats query Slavin Liu (1): ipvs: fix ipv4 null-ptr-deref in route error path Tetsuo Handa (1): bpf: Fix reference count leak in bpf_prog_test_run_xdp() Will Rosenberg (1): ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() Xiang Mei (1): net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset include/net/netfilter/nf_tables.h | 37 ++++++++---- include/net/netfilter/nft_fib.h | 4 +- include/net/netfilter/nft_meta.h | 3 +- include/net/netfilter/nft_reject.h | 3 +- net/bpf/test_run.c | 7 ++- net/bridge/netfilter/nft_meta_bridge.c | 5 +- net/bridge/netfilter/nft_reject_bridge.c | 3 +- net/ethtool/ioctl.c | 30 ++++++++-- net/ipv4/arp.c | 7 ++- net/ipv6/calipso.c | 3 +- net/ipv6/ip6_gre.c | 9 ++- net/netfilter/ipvs/ip_vs_xmit.c | 3 + net/netfilter/nf_tables_api.c | 72 ++++++++++++++++++++++-- net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_fib.c | 3 +- net/netfilter/nft_flow_offload.c | 3 +- net/netfilter/nft_fwd_netdev.c | 3 +- net/netfilter/nft_immediate.c | 3 +- net/netfilter/nft_lookup.c | 3 +- net/netfilter/nft_masq.c | 3 +- net/netfilter/nft_meta.c | 6 +- net/netfilter/nft_nat.c | 3 +- net/netfilter/nft_objref.c | 6 +- net/netfilter/nft_osf.c | 3 +- net/netfilter/nft_queue.c | 3 +- net/netfilter/nft_redir.c | 3 +- net/netfilter/nft_reject.c | 3 +- net/netfilter/nft_reject_inet.c | 3 +- net/netfilter/nft_reject_netdev.c | 3 +- net/netfilter/nft_rt.c | 3 +- net/netfilter/nft_socket.c | 3 +- net/netfilter/nft_synproxy.c | 3 +- net/netfilter/nft_tproxy.c | 3 +- net/netfilter/nft_xfrm.c | 3 +- net/sched/sch_qfq.c | 2 +- 35 files changed, 169 insertions(+), 91 deletions(-) -- 2.25.1

2 12

[PATCH OLK-6.6 0/9] CVE-2024-50102
by Qi Xi 05 Feb '26

05 Feb '26

David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (5): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 61 +++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 10 ++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 10

[PATCH OLK-6.6 0/2] Fix CVE-2025-39910
by Ze Zuo 05 Feb '26

05 Feb '26

Fix CVE-2025-39910. Alexander Gordeev (1): kasan: avoid sleepable page allocation from atomic context Uladzislau Rezki (Sony) (1): mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() include/linux/kasan.h | 6 +-- mm/kasan/shadow.c | 111 ++++++++++++++++++++++++++++++++++++------ mm/vmalloc.c | 8 +-- 3 files changed, 103 insertions(+), 22 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] Fixes CVE-2025-38627
by Ze Zuo 05 Feb '26

05 Feb '26

Fixes CVE-2025-38627. Zhiguo Niu (2): f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic fs/f2fs/compress.c | 74 +++++++++++++++++++++++----------------------- fs/f2fs/f2fs.h | 2 ++ 2 files changed, 39 insertions(+), 37 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] Fixs CVE-2025-22090
by Ze Zuo 05 Feb '26

05 Feb '26

Fixs CVE-2025-22090 David Hildenbrand (2): x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() mm: (un)track_pfn_copy() fix + doc improvements arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 31 ++++++++++++++++++----- kernel/fork.c | 4 +++ mm/memory.c | 11 +++------ 4 files changed, 61 insertions(+), 37 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/9] CVE-2024-50102
by Qi Xi 05 Feb '26

05 Feb '26

David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (5): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 61 +++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 10 ++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 10

[PATCH OLK-6.6 0/2] Fix CVE-2025-21696
by Ze Zuo 05 Feb '26

05 Feb '26

Fix CVE-2025-21696. Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() fs/userfaultfd.c | 39 --------------------------- include/linux/userfaultfd_k.h | 51 +++++++++++++++++++++++++++++++++++ mm/huge_memory.c | 12 +++++++++ mm/hugetlb.c | 14 +++++++++- mm/mremap.c | 32 +++++++++++++++++++++- 5 files changed, 107 insertions(+), 41 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 00/18] backport some net bugfix from 6.6 lts
by Zhang Changzhong 05 Feb '26

05 Feb '26

Alexey Simakov (1): sctp: avoid NULL dereference when chunk data buffer is missing Eric Dumazet (2): sctp: initialize more fields in sctp_v6_from_sk() sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Hans de Goede (1): net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Ido Schimmel (1): nexthop: Forbid FDB status change while nexthop is in a group Ilya Dryomov (1): libceph: fix potential use-after-free in have_mon_and_osd_map() Jakub Kicinski (1): tls: fix handling of zero-length records on the rx_list Jakub Ramaseuski (1): net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM Kuniyuki Iwashima (2): tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). tipc: Fix use-after-free in tipc_mon_reinit_self(). Paul Chaignon (1): bpf: Explicitly check accesses to bpf_sock_addr Slavin Liu (1): ipvs: Defer ip_vs_ftp unregister during netns cleanup Stefan Wiehler (3): sctp: Hold RCU read lock while iterating over address list sctp: Prevent TOCTOU out-of-bounds write sctp: Hold sock lock while iterating over address list Wang Liang (1): netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm ziming zhang (2): libceph: prevent potential out-of-bounds writes in handle_auth_session_key() libceph: replace BUG_ON with bounds check for map->max_osd net/bridge/br_netfilter_hooks.c | 3 --- net/ceph/auth_x.c | 2 ++ net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++---------------- net/ceph/debugfs.c | 14 +++++++---- net/ceph/osdmap.c | 18 ++++++++------ net/core/dev.c | 12 ++++++++++ net/core/filter.c | 16 ++++++++----- net/ipv4/nexthop.c | 7 ++++++ net/ipv4/tcp.c | 5 ++++ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- net/rfkill/rfkill-gpio.c | 4 ++-- net/sctp/diag.c | 21 ++++++++++++---- net/sctp/inqueue.c | 13 +++++----- net/sctp/ipv6.c | 2 ++ net/sctp/transport.c | 13 ++++++---- net/tipc/net.c | 2 ++ net/tls/tls_sw.c | 7 +++++- 17 files changed, 136 insertions(+), 60 deletions(-) -- 2.9.5

2 19

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 05 Feb '26

05 Feb '26

From: Gregory Price <gourry(a)gourry.net> mainline inclusion from mainline-v6.18-rc3 commit 607b9fb2ce248cc5b633c5949e0153838992c152 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index d7a8f8bb9026..9990e058b6e8 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1128,8 +1128,18 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static const struct x86_cpu_id zen5_rdseed_microcode[] = { + ZEN_MODEL_STEP_UCODE(0x1a, 0x02, 0x1, 0x0b00215a), + ZEN_MODEL_STEP_UCODE(0x1a, 0x11, 0x0, 0x0b101054), +}; + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!x86_match_min_microcode_rev(zen5_rdseed_microcode)) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] nohz_full stall
by Zicheng Qu 05 Feb '26

05 Feb '26

Vincent Guittot (1): sched/fair: Prevent unlimited runtime on throttled group Zicheng Qu (1): sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups kernel/sched/core.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 05 Feb '26

05 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index d7a8f8bb9026..9990e058b6e8 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1128,8 +1128,18 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static const struct x86_cpu_id zen5_rdseed_microcode[] = { + ZEN_MODEL_STEP_UCODE(0x1a, 0x02, 0x1, 0x0b00215a), + ZEN_MODEL_STEP_UCODE(0x1a, 0x11, 0x0, 0x0b101054), +}; + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!x86_match_min_microcode_rev(zen5_rdseed_microcode)) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-6.6] pmdomain: arm: scmi: Fix genpd leak on provider registration failure
by Bowen You 05 Feb '26

05 Feb '26

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v6.6.118 commit ad120c08b89a81d41d091490bbe150343473b659 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If of_genpd_add_provider_onecell() fails during probe, the previously created generic power domains are not removed, leading to a memory leak and potential kernel crash later in genpd_debug_add(). Add proper error handling to unwind the initialized domains before returning from probe to ensure all resources are correctly released on failure. Example crash trace observed without this fix: | Unable to handle kernel paging request at virtual address fffffffffffffc70 | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : genpd_debug_add+0x2c/0x160 | lr : genpd_debug_init+0x74/0x98 | Call trace: | genpd_debug_add+0x2c/0x160 (P) | genpd_debug_init+0x74/0x98 | do_one_initcall+0xd0/0x2d8 | do_initcall_level+0xa0/0x140 | do_initcalls+0x60/0xa8 | do_basic_setup+0x28/0x40 | kernel_init_freeable+0xe8/0x170 | kernel_init+0x2c/0x140 | ret_from_fork+0x10/0x20 Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd") Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Reviewed-by: Peng Fan <peng.fan(a)nxp.com> Cc: stable(a)vger.kernel.org Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/firmware/arm_scmi/scmi_pm_domain.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c index 0e05a79de82d..82d923a9d75d 100644 --- a/drivers/firmware/arm_scmi/scmi_pm_domain.c +++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c @@ -54,7 +54,7 @@ static int scmi_pd_power_off(struct generic_pm_domain *domain) static int scmi_pm_domain_probe(struct scmi_device *sdev) { - int num_domains, i; + int num_domains, i, ret; struct device *dev = &sdev->dev; struct device_node *np = dev->of_node; struct scmi_pm_domain *scmi_pd; @@ -112,9 +112,18 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) scmi_pd_data->domains = domains; scmi_pd_data->num_domains = num_domains; + ret = of_genpd_add_provider_onecell(np, scmi_pd_data); + if (ret) + goto err_rm_genpds; + dev_set_drvdata(dev, scmi_pd_data); - return of_genpd_add_provider_onecell(np, scmi_pd_data); + return 0; +err_rm_genpds: + for (i = num_domains - 1; i >= 0; i--) + pm_genpd_remove(domains[i]); + + return ret; } static void scmi_pm_domain_remove(struct scmi_device *sdev) -- 2.34.1

2 1

[PATCH OLK-6.6] powerpc/64s/slb: Fix SLB multihit issue during SLB preload
by Zeng Heng 05 Feb '26

05 Feb '26

From: Donet Tom <donettom(a)linux.ibm.com> stable inclusion from stable-v6.6.120 commit b13a3dbfa196af68eae2031f209743735ad416bf category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/13389 CVE: CVE-2025-71078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 00312419f0863964625d6dcda8183f96849412c6 upstream. On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache is subject to periodic eviction — typically after every 256 context switches — to remove old entry. To optimize performance, the kernel skips switch_mmu_context() in switch_mm_irqs_off() when the prev and next mm_struct are the same. However, on hash MMU systems, this can lead to inconsistencies between the hardware SLB and the software preload cache. If an SLB entry for a process is evicted from the software cache on one CPU, and the same process later runs on another CPU without executing switch_mmu_context(), the hardware SLB may retain stale entries. If the kernel then attempts to reload that entry, it can trigger an SLB multi-hit error. The following timeline shows how stale SLB entries are created and can cause a multi-hit error when a process moves between CPUs without a MMU context switch. CPU 0 CPU 1 ----- ----- Process P exec swapper/1 load_elf_binary begin_new_exc activate_mm switch_mm_irqs_off switch_mmu_context switch_slb /* * This invalidates all * the entries in the HW * and setup the new HW * SLB entries as per the * preload cache. */ context_switch sched_migrate_task migrates process P to cpu-1 Process swapper/0 context switch (to process P) (uses mm_struct of Process P) switch_mm_irqs_off() switch_slb load_slb++ /* * load_slb becomes 0 here * and we evict an entry from * the preload cache with * preload_age(). We still * keep HW SLB and preload * cache in sync, that is * because all HW SLB entries * anyways gets evicted in * switch_slb during SLBIA. * We then only add those * entries back in HW SLB, * which are currently * present in preload_cache * (after eviction). */ load_elf_binary continues... setup_new_exec() slb_setup_new_exec() sched_switch event sched_migrate_task migrates process P to cpu-0 context_switch from swapper/0 to Process P switch_mm_irqs_off() /* * Since both prev and next mm struct are same we don't call * switch_mmu_context(). This will cause the HW SLB and SW preload * cache to go out of sync in preload_new_slb_context. Because there * was an SLB entry which was evicted from both HW and preload cache * on cpu-1. Now later in preload_new_slb_context(), when we will try * to add the same preload entry again, we will add this to the SW * preload cache and then will add it to the HW SLB. Since on cpu-0 * this entry was never invalidated, hence adding this entry to the HW * SLB will cause a SLB multi-hit error. */ load_elf_binary continues... START_THREAD start_thread preload_new_slb_context /* * This tries to add a new EA to preload cache which was earlier * evicted from both cpu-1 HW SLB and preload cache. This caused the * HW SLB of cpu-0 to go out of sync with the SW preload cache. The * reason for this was, that when we context switched back on CPU-0, * we should have ideally called switch_mmu_context() which will * bring the HW SLB entries on CPU-0 in sync with SW preload cache * entries by setting up the mmu context properly. But we didn't do * that since the prev mm_struct running on cpu-0 was same as the * next mm_struct (which is true for swapper / kernel threads). So * now when we try to add this new entry into the HW SLB of cpu-0, * we hit a SLB multi-hit error. */ WARNING: CPU: 0 PID: 1810970 at arch/powerpc/mm/book3s64/slb.c:62 assert_slb_presence+0x2c/0x50(48 results) 02:47:29 [20157/42149] Modules linked in: CPU: 0 UID: 0 PID: 1810970 Comm: dd Not tainted 6.16.0-rc3-dirty #12 VOLUNTARY Hardware name: IBM pSeries (emulated by qemu) POWER8 (architected) 0x4d0200 0xf000004 of:SLOF,HEAD hv:linux,kvm pSeries NIP: c00000000015426c LR: c0000000001543b4 CTR: 0000000000000000 REGS: c0000000497c77e0 TRAP: 0700 Not tainted (6.16.0-rc3-dirty) MSR: 8000000002823033 <SF,VEC,VSX,FP,ME,IR,DR,RI,LE> CR: 28888482 XER: 00000000 CFAR: c0000000001543b0 IRQMASK: 3 <...> NIP [c00000000015426c] assert_slb_presence+0x2c/0x50 LR [c0000000001543b4] slb_insert_entry+0x124/0x390 Call Trace: 0x7fffceb5ffff (unreliable) preload_new_slb_context+0x100/0x1a0 start_thread+0x26c/0x420 load_elf_binary+0x1b04/0x1c40 bprm_execve+0x358/0x680 do_execveat_common+0x1f8/0x240 sys_execve+0x58/0x70 system_call_exception+0x114/0x300 system_call_common+0x160/0x2c4 >From the above analysis, during early exec the hardware SLB is cleared, and entries from the software preload cache are reloaded into hardware by switch_slb. However, preload_new_slb_context and slb_setup_new_exec also attempt to load some of the same entries, which can trigger a multi-hit. In most cases, these additional preloads simply hit existing entries and add nothing new. Removing these functions avoids redundant preloads and eliminates the multi-hit issue. This patch removes these two functions. We tested process switching performance using the context_switch benchmark on POWER9/hash, and observed no regression. Without this patch: 129041 ops/sec With this patch: 129341 ops/sec We also measured SLB faults during boot, and the counts are essentially the same with and without this patch. SLB faults without this patch: 19727 SLB faults with this patch: 19786 Fixes: 5434ae74629a ("powerpc/64s/hash: Add a SLB preload cache") cc: stable(a)vger.kernel.org Suggested-by: Nicholas Piggin <npiggin(a)gmail.com> Signed-off-by: Donet Tom <donettom(a)linux.ibm.com> Signed-off-by: Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> Signed-off-by: Madhavan Srinivasan <maddy(a)linux.ibm.com> Link: https://patch.msgid.link/0ac694ae683494fe8cadbd911a1a5018d5d3c541.176183416… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/powerpc/include/asm/book3s/64/mmu-hash.h | 1 - arch/powerpc/kernel/process.c | 5 -- arch/powerpc/mm/book3s64/internal.h | 2 - arch/powerpc/mm/book3s64/mmu_context.c | 2 - arch/powerpc/mm/book3s64/slb.c | 88 ------------------- 5 files changed, 98 deletions(-) diff --git a/arch/powerpc/include/asm/book3s/64/mmu-hash.h b/arch/powerpc/include/asm/book3s/64/mmu-hash.h index 1c4eebbc69c9..e1f77e2eead4 100644 --- a/arch/powerpc/include/asm/book3s/64/mmu-hash.h +++ b/arch/powerpc/include/asm/book3s/64/mmu-hash.h @@ -524,7 +524,6 @@ void slb_save_contents(struct slb_entry *slb_ptr); void slb_dump_contents(struct slb_entry *slb_ptr); extern void slb_vmalloc_update(void); -void preload_new_slb_context(unsigned long start, unsigned long sp); #ifdef CONFIG_PPC_64S_HASH_MMU void slb_set_size(u16 size); diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c index 9452a54d356c..dd23025ef2e1 100644 --- a/arch/powerpc/kernel/process.c +++ b/arch/powerpc/kernel/process.c @@ -1882,8 +1882,6 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) return 0; } -void preload_new_slb_context(unsigned long start, unsigned long sp); - /* * Set up a thread for executing a new program */ @@ -1891,9 +1889,6 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp) { #ifdef CONFIG_PPC64 unsigned long load_addr = regs->gpr[2]; /* saved by ELF_PLAT_INIT */ - - if (IS_ENABLED(CONFIG_PPC_BOOK3S_64) && !radix_enabled()) - preload_new_slb_context(start, sp); #endif #ifdef CONFIG_PPC_TRANSACTIONAL_MEM diff --git a/arch/powerpc/mm/book3s64/internal.h b/arch/powerpc/mm/book3s64/internal.h index a57a25f06a21..c26a6f0c90fc 100644 --- a/arch/powerpc/mm/book3s64/internal.h +++ b/arch/powerpc/mm/book3s64/internal.h @@ -24,8 +24,6 @@ static inline bool stress_hpt(void) void hpt_do_stress(unsigned long ea, unsigned long hpte_group); -void slb_setup_new_exec(void); - void exit_lazy_flush_tlb(struct mm_struct *mm, bool always_flush); #endif /* ARCH_POWERPC_MM_BOOK3S64_INTERNAL_H */ diff --git a/arch/powerpc/mm/book3s64/mmu_context.c b/arch/powerpc/mm/book3s64/mmu_context.c index 1715b07c630c..997bc13a690e 100644 --- a/arch/powerpc/mm/book3s64/mmu_context.c +++ b/arch/powerpc/mm/book3s64/mmu_context.c @@ -150,8 +150,6 @@ static int hash__init_new_context(struct mm_struct *mm) void hash__setup_new_exec(void) { slice_setup_new_exec(); - - slb_setup_new_exec(); } #else static inline int hash__init_new_context(struct mm_struct *mm) diff --git a/arch/powerpc/mm/book3s64/slb.c b/arch/powerpc/mm/book3s64/slb.c index f2708c8629a5..8e8d5da7b482 100644 --- a/arch/powerpc/mm/book3s64/slb.c +++ b/arch/powerpc/mm/book3s64/slb.c @@ -328,94 +328,6 @@ static void preload_age(struct thread_info *ti) ti->slb_preload_tail = (ti->slb_preload_tail + 1) % SLB_PRELOAD_NR; } -void slb_setup_new_exec(void) -{ - struct thread_info *ti = current_thread_info(); - struct mm_struct *mm = current->mm; - unsigned long exec = 0x10000000; - - WARN_ON(irqs_disabled()); - - /* - * preload cache can only be used to determine whether a SLB - * entry exists if it does not start to overflow. - */ - if (ti->slb_preload_nr + 2 > SLB_PRELOAD_NR) - return; - - hard_irq_disable(); - - /* - * We have no good place to clear the slb preload cache on exec, - * flush_thread is about the earliest arch hook but that happens - * after we switch to the mm and have already preloaded the SLBEs. - * - * For the most part that's probably okay to use entries from the - * previous exec, they will age out if unused. It may turn out to - * be an advantage to clear the cache before switching to it, - * however. - */ - - /* - * preload some userspace segments into the SLB. - * Almost all 32 and 64bit PowerPC executables are linked at - * 0x10000000 so it makes sense to preload this segment. - */ - if (!is_kernel_addr(exec)) { - if (preload_add(ti, exec)) - slb_allocate_user(mm, exec); - } - - /* Libraries and mmaps. */ - if (!is_kernel_addr(mm->mmap_base)) { - if (preload_add(ti, mm->mmap_base)) - slb_allocate_user(mm, mm->mmap_base); - } - - /* see switch_slb */ - asm volatile("isync" : : : "memory"); - - local_irq_enable(); -} - -void preload_new_slb_context(unsigned long start, unsigned long sp) -{ - struct thread_info *ti = current_thread_info(); - struct mm_struct *mm = current->mm; - unsigned long heap = mm->start_brk; - - WARN_ON(irqs_disabled()); - - /* see above */ - if (ti->slb_preload_nr + 3 > SLB_PRELOAD_NR) - return; - - hard_irq_disable(); - - /* Userspace entry address. */ - if (!is_kernel_addr(start)) { - if (preload_add(ti, start)) - slb_allocate_user(mm, start); - } - - /* Top of stack, grows down. */ - if (!is_kernel_addr(sp)) { - if (preload_add(ti, sp)) - slb_allocate_user(mm, sp); - } - - /* Bottom of heap, grows up. */ - if (heap && !is_kernel_addr(heap)) { - if (preload_add(ti, heap)) - slb_allocate_user(mm, heap); - } - - /* see switch_slb */ - asm volatile("isync" : : : "memory"); - - local_irq_enable(); -} - static void slb_cache_slbie_kernel(unsigned int index) { unsigned long slbie_data = get_paca()->slb_cache[index]; -- 2.25.1

2 1

[PATCH OLK-6.6] mm/huge_memory: fix NULL pointer deference when splitting folio
by Zeng Heng 05 Feb '26

05 Feb '26

From: Wei Yang <richard.weiyang(a)gmail.com> mainline inclusion from mainline-v6.18 commit cff47b9e39a6abf03dde5f4f156f841b0c54bba0 category: bugfix bugzilla: https://gitcode.com/src-openeuler/kernel/issues/11518 CVE: CVE-2025-68293 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit c010d47f107f ("mm: thp: split huge page to any lower order pages") introduced an early check on the folio's order via mapping->flags before proceeding with the split work. This check introduced a bug: for shmem folios in the swap cache and truncated folios, the mapping pointer can be NULL. Accessing mapping->flags in this state leads directly to a NULL pointer dereference. This commit fixes the issue by moving the check for mapping != NULL before any attempt to access mapping->flags. Link: https://lkml.kernel.org/r/20251119235302.24773-1-richard.weiyang@gmail.com Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages") Signed-off-by: Wei Yang <richard.weiyang(a)gmail.com> Reviewed-by: Zi Yan <ziy(a)nvidia.com> Acked-by: David Hildenbrand (Red Hat) <david(a)kernel.org> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/huge_memory.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- mm/huge_memory.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 2bd84157869e..8ed51bf8a3b4 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3599,6 +3599,16 @@ int split_huge_page_to_list_to_order(struct page *page, struct list_head *list, VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio); VM_BUG_ON_FOLIO(!folio_test_large(folio), folio); + /* + * Folios that just got truncated cannot get split. Signal to the + * caller that there was a race. + * + * TODO: this will also currently refuse shmem folios that are in the + * swapcache. + */ + if (!is_anon && !folio->mapping) + return -EBUSY; + if (new_order >= folio_order(folio)) return -EINVAL; @@ -3664,12 +3674,6 @@ int split_huge_page_to_list_to_order(struct page *page, struct list_head *list, mapping = folio->mapping; - /* Truncated ? */ - if (!mapping) { - ret = -EBUSY; - goto out; - } - gfp = current_gfp_context(mapping_gfp_mask(mapping) & GFP_RECLAIM_MASK); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] nohz_full stall
by Zicheng Qu 05 Feb '26

05 Feb '26

Vincent Guittot (1): sched/fair: Prevent unlimited runtime on throttled group Zicheng Qu (1): sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups kernel/sched/core.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] team: fix check for port enabled in team_queue_override_port_prio_changed()
by Ze Zuo 05 Feb '26

05 Feb '26

From: Jiri Pirko <jiri(a)nvidia.com> stable inclusion from stable-v6.6.120 commit 6bfb62b6010a16112dcae52f490e5e0e6abe12a3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13402 CVE: CVE-2025-71091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 932ac51d9953eaf77a1252f79b656d4ca86163c6 ] There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59 Code: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d49f370 EFLAGS: 00010286 RAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000 RDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005 RBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230 R13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480 FS: 00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_rcu include/linux/rculist.h:178 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline] team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline] team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534 team_option_set drivers/net/team/team_core.c:376 [inline] team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653 genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684 __sys_sendmsg+0x16d/0x220 net/socket.c:2716 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The problem is in this flow: 1) Port is enabled, queue_id != 0, in qom_list 2) Port gets disabled -> team_port_disable() -> team_queue_override_port_del() -> del (removed from list) 3) Port is disabled, queue_id != 0, not in any list 4) Priority changes -> team_queue_override_port_prio_changed() -> checks: port disabled && queue_id != 0 -> calls del - hits the BUG as it is removed already To fix this, change the check in team_queue_override_port_prio_changed() so it returns early if port is not enabled. Reported-by: syzbot+422806e5f4cce722a71f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=422806e5f4cce722a71f Fixes: 6c31ff366c11 ("team: remove synchronize_rcu() called during queue override change") Signed-off-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20251212102953.167287-1-jiri@resnulli.us Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/team/team.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index 1ce3bccd4ebd..9baa13808933 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -876,7 +876,7 @@ static void __team_queue_override_enabled_check(struct team *team) static void team_queue_override_port_prio_changed(struct team *team, struct team_port *port) { - if (!port->queue_id || team_port_enabled(port)) + if (!port->queue_id || !team_port_enabled(port)) return; __team_queue_override_port_del(team, port); __team_queue_override_port_add(team, port); -- 2.25.1

2 1

[PATCH OLK-5.10] team: fix check for port enabled in team_queue_override_port_prio_changed()
by Ze Zuo 05 Feb '26

05 Feb '26

From: Jiri Pirko <jiri(a)nvidia.com> stable inclusion from stable-v6.6.120 commit 6bfb62b6010a16112dcae52f490e5e0e6abe12a3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13402 CVE: CVE-2025-71091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 932ac51d9953eaf77a1252f79b656d4ca86163c6 ] There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59 Code: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d49f370 EFLAGS: 00010286 RAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000 RDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005 RBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230 R13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480 FS: 00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_rcu include/linux/rculist.h:178 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline] team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline] team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534 team_option_set drivers/net/team/team_core.c:376 [inline] team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653 genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684 __sys_sendmsg+0x16d/0x220 net/socket.c:2716 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The problem is in this flow: 1) Port is enabled, queue_id != 0, in qom_list 2) Port gets disabled -> team_port_disable() -> team_queue_override_port_del() -> del (removed from list) 3) Port is disabled, queue_id != 0, not in any list 4) Priority changes -> team_queue_override_port_prio_changed() -> checks: port disabled && queue_id != 0 -> calls del - hits the BUG as it is removed already To fix this, change the check in team_queue_override_port_prio_changed() so it returns early if port is not enabled. Reported-by: syzbot+422806e5f4cce722a71f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=422806e5f4cce722a71f Fixes: 6c31ff366c11 ("team: remove synchronize_rcu() called during queue override change") Signed-off-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20251212102953.167287-1-jiri@resnulli.us Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/team/team.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index 49d7030ddc1b..ea5a75e7ee53 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -872,7 +872,7 @@ static void __team_queue_override_enabled_check(struct team *team) static void team_queue_override_port_prio_changed(struct team *team, struct team_port *port) { - if (!port->queue_id || team_port_enabled(port)) + if (!port->queue_id || !team_port_enabled(port)) return; __team_queue_override_port_del(team, port); __team_queue_override_port_add(team, port); -- 2.25.1

2 1

[PATCH OLK-6.6] mm/page_alloc: prevent pcp corruption with SMP=n
by Ze Zuo 05 Feb '26

05 Feb '26

From: Vlastimil Babka <vbabka(a)suse.cz> stable inclusion from stable-v6.6.122 commit 4a04ff9cd816e7346fcc8126f00ed80481f6569d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13530 CVE: CVE-2026-23025 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 038a102535eb49e10e93eafac54352fcc5d78847 ] The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0 CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT 8cc09ef94dcec767faa911515ce9e609c45db470 Call Trace: <IRQ> __dump_stack (lib/dump_stack.c:95) dump_stack_lvl (lib/dump_stack.c:123) dump_stack (lib/dump_stack.c:130) spin_dump (kernel/locking/spinlock_debug.c:71) do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?) _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138) __free_frozen_pages (mm/page_alloc.c:2973) ___free_pages (mm/page_alloc.c:5295) __free_pages (mm/page_alloc.c:5334) tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290) ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289) ? rcu_core (kernel/rcu/tree.c:?) rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861) rcu_core_si (kernel/rcu/tree.c:2879) handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623) __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725) irq_exit_rcu (kernel/softirq.c:741) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052) </IRQ> <TASK> RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) free_pcppages_bulk (mm/page_alloc.c:1494) drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632) __drain_all_pages (mm/page_alloc.c:2731) drain_all_pages (mm/page_alloc.c:2747) kcompactd (mm/compaction.c:3115) kthread (kernel/kthread.c:465) ? __cfi_kcompactd (mm/compaction.c:3166) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork (arch/x86/kernel/process.c:164) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) </TASK> Matthew has analyzed the report and identified that in drain_page_zone() we are in a section protected by spin_lock(&pcp->lock) and then get an interrupt that attempts spin_trylock() on the same lock. The code is designed to work this way without disabling IRQs and occasionally fail the trylock with a fallback. However, the SMP=n spinlock implementation assumes spin_trylock() will always succeed, and thus it's normally a no-op. Here the enabled lock debugging catches the problem, but otherwise it could cause a corruption of the pcp structure. The problem has been introduced by commit 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations"). The pcp locking scheme recognizes the need for disabling IRQs to prevent nesting spin_trylock() sections on SMP=n, but the need to prevent the nesting in spin_lock() has not been recognized. Fix it by introducing local wrappers that change the spin_lock() to spin_lock_iqsave() with SMP=n and use them in all places that do spin_lock(&pcp->lock). [vbabka(a)suse.cz: add pcp_ prefix to the spin_lock_irqsave wrappers, per Steven] Link: https://lkml.kernel.org/r/20260105-fix-pcp-up-v1-1-5579662d2071@suse.cz Fixes: 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations") Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Reported-by: kernel test robot <oliver.sang(a)intel.com> Closes: https://lore.kernel.org/oe-lkp/202512101320.e2f2dd6f-lkp@intel.com Analyzed-by: Matthew Wilcox <willy(a)infradead.org> Link: https://lore.kernel.org/all/aUW05pyc9nZkvY-1@casper.infradead.org/ Acked-by: Mel Gorman <mgorman(a)techsingularity.net> Cc: Brendan Jackman <jackmanb(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Zi Yan <ziy(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ drop changes to decay_pcp_high() and zone_pcp_update_cacheinfo() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/page_alloc.c | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 2bc511aa784c..aeb4ad15f751 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -164,6 +164,33 @@ static DEFINE_MUTEX(pcp_batch_high_lock); #define pcp_spin_unlock(ptr) \ pcpu_spin_unlock(lock, ptr) +/* + * With the UP spinlock implementation, when we spin_lock(&pcp->lock) (for i.e. + * a potentially remote cpu drain) and get interrupted by an operation that + * attempts pcp_spin_trylock(), we can't rely on the trylock failure due to UP + * spinlock assumptions making the trylock a no-op. So we have to turn that + * spin_lock() to a spin_lock_irqsave(). This works because on UP there are no + * remote cpu's so we can only be locking the only existing local one. + */ +#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_RT) +static inline void __flags_noop(unsigned long *flags) { } +#define pcp_spin_lock_maybe_irqsave(ptr, flags) \ +({ \ + __flags_noop(&(flags)); \ + spin_lock(&(ptr)->lock); \ +}) +#define pcp_spin_unlock_maybe_irqrestore(ptr, flags) \ +({ \ + spin_unlock(&(ptr)->lock); \ + __flags_noop(&(flags)); \ +}) +#else +#define pcp_spin_lock_maybe_irqsave(ptr, flags) \ + spin_lock_irqsave(&(ptr)->lock, flags) +#define pcp_spin_unlock_maybe_irqrestore(ptr, flags) \ + spin_unlock_irqrestore(&(ptr)->lock, flags) +#endif + #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID DEFINE_PER_CPU(int, numa_node); EXPORT_PER_CPU_SYMBOL(numa_node); @@ -2391,14 +2418,15 @@ int decay_pcp_high(struct zone *zone, struct per_cpu_pages *pcp) */ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp) { + unsigned long UP_flags; int to_drain, batch; batch = READ_ONCE(pcp->batch); to_drain = min(pcp->count, batch); if (to_drain > 0) { - spin_lock(&pcp->lock); + pcp_spin_lock_maybe_irqsave(pcp, UP_flags); free_pcppages_bulk(zone, to_drain, pcp, 0); - spin_unlock(&pcp->lock); + pcp_spin_unlock_maybe_irqrestore(pcp, UP_flags); } } #endif @@ -2409,10 +2437,11 @@ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp) static void drain_pages_zone(unsigned int cpu, struct zone *zone) { struct per_cpu_pages *pcp = per_cpu_ptr(zone->per_cpu_pageset, cpu); + unsigned long UP_flags; int count; do { - spin_lock(&pcp->lock); + pcp_spin_lock_maybe_irqsave(pcp, UP_flags); count = pcp->count; if (count) { int to_drain = min(count, @@ -2421,7 +2450,7 @@ static void drain_pages_zone(unsigned int cpu, struct zone *zone) free_pcppages_bulk(zone, to_drain, pcp, 0); count -= to_drain; } - spin_unlock(&pcp->lock); + pcp_spin_unlock_maybe_irqrestore(pcp, UP_flags); } while (count); } -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 05 Feb '26

05 Feb '26

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/2] CVE-2025-39744 fixup
by Jiacheng Yu 04 Feb '26

04 Feb '26

*** BLURB HERE *** Frederic Weisbecker (1): rcu: Fix racy re-initialization of irq_work causing hangs Joel Fernandes (1): rcu: Fix rcu_read_unlock() deadloop due to IRQ work kernel/rcu/tree.c | 2 ++ kernel/rcu/tree.h | 14 +++++++++++++- kernel/rcu/tree_plugin.h | 41 +++++++++++++++++++++++++++++----------- 3 files changed, 45 insertions(+), 12 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10 0/3] CVE-2025-39744 fixup
by Jiacheng Yu 04 Feb '26

04 Feb '26

*** BLURB HERE *** Frederic Weisbecker (1): rcu: Fix racy re-initialization of irq_work causing hangs Joel Fernandes (1): rcu: Fix rcu_read_unlock() deadloop due to IRQ work Zqiang (1): rcu: Use IRQ_WORK_INIT_HARD() to avoid rcu_read_unlock() hangs kernel/rcu/tree.c | 1 + kernel/rcu/tree.h | 14 +++++++++++++- kernel/rcu/tree_plugin.h | 36 ++++++++++++++++++++++++++++++------ 3 files changed, 44 insertions(+), 7 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/2] CVE-2025-71141 fixup
by Jiacheng Yu 04 Feb '26

04 Feb '26

*** BLURB HERE *** Kory Maincent (TI.com) (1): drm/tilcdc: Fix removal actions in case of failed probe Philipp Stanner (1): drm/tilcdc: request and mapp iomem with devres drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 2 +- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 72 +++++++++++++++------------- drivers/gpu/drm/tilcdc/tilcdc_drv.h | 2 +- 3 files changed, 41 insertions(+), 35 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] dmaengine: stm32: dmamux: fix device leak on route allocation
by Yin Tirui 04 Feb '26

04 Feb '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v6.6.122 commit 1a179ac01ff3993ab97e33cc77c316ed7415cda1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13527 CVE: CVE-2025-71186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dd6e4943889fb354efa3f700e42739da9bddb6ef ] Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver") Cc: stable(a)vger.kernel.org # 4.15 Cc: Pierre-Yves MORDRET <pierre-yves.mordret(a)foss.st.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> Reviewed-by: Amelie Delaunay <amelie.delaunay(a)foss.st.com> Link: https://patch.msgid.link/20251117161258.10679-11-johan@kernel.org Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/dma/stm32-dmamux.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/dma/stm32-dmamux.c b/drivers/dma/stm32-dmamux.c index 8d77e2a7939a..791179760782 100644 --- a/drivers/dma/stm32-dmamux.c +++ b/drivers/dma/stm32-dmamux.c @@ -90,23 +90,25 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, struct stm32_dmamux_data *dmamux = platform_get_drvdata(pdev); struct stm32_dmamux *mux; u32 i, min, max; - int ret; + int ret = -EINVAL; unsigned long flags; if (dma_spec->args_count != 3) { dev_err(&pdev->dev, "invalid number of dma mux args\n"); - return ERR_PTR(-EINVAL); + goto err_put_pdev; } if (dma_spec->args[0] > dmamux->dmamux_requests) { dev_err(&pdev->dev, "invalid mux request number: %d\n", dma_spec->args[0]); - return ERR_PTR(-EINVAL); + goto err_put_pdev; } mux = kzalloc(sizeof(*mux), GFP_KERNEL); - if (!mux) - return ERR_PTR(-ENOMEM); + if (!mux) { + ret = -ENOMEM; + goto err_put_pdev; + } spin_lock_irqsave(&dmamux->lock, flags); mux->chan_id = find_first_zero_bit(dmamux->dma_inuse, @@ -133,7 +135,6 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", i - 1); if (!dma_spec->np) { dev_err(&pdev->dev, "can't get dma master\n"); - ret = -EINVAL; goto error; } @@ -160,6 +161,8 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, dev_dbg(&pdev->dev, "Mapping DMAMUX(%u) to DMA%u(%u)\n", mux->request, mux->master, mux->chan_id); + put_device(&pdev->dev); + return mux; error: @@ -167,6 +170,9 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, error_chan_id: kfree(mux); +err_put_pdev: + put_device(&pdev->dev); + return ERR_PTR(ret); } -- 2.43.0

2 1

[PATCH v3 0/3] arm64/riscv: Add support for crashkernel CMA reservation
by Jinjie Ruan 04 Feb '26

04 Feb '26

Add support for crashkernel CMA reservation for arm64 and riscv. By the way, exclude crash kernel memory in crash core to avoid duplication. Changs in v3: - Exclude crash kernel memory in crash core as Mike suggested. - Add acked-by. Jinjie Ruan (3): crash: Exclude crash kernel memory in crash core arm64: kexec: Add support for crashkernel CMA reservation riscv: kexec: Add support for crashkernel CMA reservation .../admin-guide/kernel-parameters.txt | 16 ++++---- arch/arm64/kernel/machine_kexec_file.c | 16 +++----- arch/arm64/mm/init.c | 5 ++- arch/loongarch/kernel/machine_kexec_file.c | 12 ------ arch/powerpc/kexec/ranges.c | 16 ++------ arch/riscv/kernel/machine_kexec_file.c | 15 ++++--- arch/riscv/mm/init.c | 5 ++- arch/x86/kernel/crash.c | 39 +------------------ kernel/crash_core.c | 28 +++++++++++++ 9 files changed, 61 insertions(+), 91 deletions(-) -- 2.34.1

1 3

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 04 Feb '26

04 Feb '26

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] null_blk: fix kmemleak by releasing references to fault configfs items
by Zheng Qixing 04 Feb '26

04 Feb '26

From: Nilay Shroff <nilay(a)linux.ibm.com> stable inclusion from stable-v6.6.122 commit 1a3286edf4d48ce37f8982ff3c3b65159a5ecbb2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13556 CVE: CVE-2026-23032 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 40b94ec7edbbb867c4e26a1a43d2b898f04b93c5 upstream. When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk driver sets up fault injection support by creating the timeout_inject, requeue_inject, and init_hctx_fault_inject configfs items as children of the top-level nullbX configfs group. However, when the nullbX device is removed, the references taken to these fault-config configfs items are not released. As a result, kmemleak reports a memory leak, for example: unreferenced object 0xc00000021ff25c40 (size 32): comm "mkdir", pid 10665, jiffies 4322121578 hex dump (first 32 bytes): 69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f init_hctx_fault_ 69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00 inject.......... backtrace (crc 1a018c86): __kmalloc_node_track_caller_noprof+0x494/0xbd8 kvasprintf+0x74/0xf4 config_item_set_name+0xf0/0x104 config_group_init_type_name+0x48/0xfc fault_config_init+0x48/0xf0 0xc0080000180559e4 configfs_mkdir+0x304/0x814 vfs_mkdir+0x49c/0x604 do_mkdirat+0x314/0x3d0 sys_mkdir+0xa0/0xd8 system_call_exception+0x1b0/0x4f0 system_call_vectored_common+0x15c/0x2ec Fix this by explicitly releasing the references to the fault-config configfs items when dropping the reference to the top-level nullbX configfs group. Cc: stable(a)vger.kernel.org Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Fixes: bb4c19e030f4 ("block: null_blk: make fault-injection dynamically configurable per device") Signed-off-by: Nilay Shroff <nilay(a)linux.ibm.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/block/null_blk/main.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index 97ed3bd9707f..217a6b788dfa 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -622,12 +622,22 @@ static void nullb_add_fault_config(struct nullb_device *dev) configfs_add_default_group(&dev->init_hctx_fault_config.group, &dev->group); } +static void nullb_del_fault_config(struct nullb_device *dev) +{ + config_item_put(&dev->init_hctx_fault_config.group.cg_item); + config_item_put(&dev->requeue_config.group.cg_item); + config_item_put(&dev->timeout_config.group.cg_item); +} + #else static void nullb_add_fault_config(struct nullb_device *dev) { } +static void nullb_del_fault_config(struct nullb_device *dev) +{ +} #endif static struct @@ -659,7 +669,7 @@ nullb_group_drop_item(struct config_group *group, struct config_item *item) null_del_dev(dev->nullb); mutex_unlock(&lock); } - + nullb_del_fault_config(dev); config_item_put(item); } -- 2.39.2

2 1

[PATCH OLK-6.6] RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
by Wang Tao 04 Feb '26

04 Feb '26

From: Jason Gunthorpe <jgg(a)nvidia.com> stable inclusion from stable-v6.6.120 commit 9d85524789c2f17c0e87de8d596bcccc3683a1fc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13407 CVE: CVE-2025-71096 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a7b8e876e0ef0232b8076972c57ce9a7286b47ca upstream. The netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a LS_NLA_TYPE_DGID attribute, it is invalid if it does not. Use the nl parsing logic properly and call nla_parse_deprecated() to fill the nlattrs array and then directly index that array to get the data for the DGID. Just fail if it is NULL. Remove the for loop searching for the nla, and squash the validation and parsing into one function. Fixes an uninitialized read from the stack triggered by userspace if it does not provide the DGID to a kernel initiated RDMA_NL_LS_OP_IP_RESOLVE query. BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline] BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490 hex_byte_pack include/linux/hex.h:13 [inline] ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490 ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509 ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633 pointer+0xc09/0x1bd0 lib/vsprintf.c:2542 vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930 vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279 vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426 vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465 vprintk+0x36/0x50 kernel/printk/printk_safe.c:82 _printk+0x17e/0x1b0 kernel/printk/printk.c:2475 ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline] ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline] rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x333/0x3d0 net/socket.c:729 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671 __sys_sendmsg+0x1aa/0x300 net/socket.c:2703 __compat_sys_sendmsg net/compat.c:346 [inline] __do_compat_sys_sendmsg net/compat.c:353 [inline] __se_compat_sys_sendmsg net/compat.c:350 [inline] __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350 ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:3 Link: https://patch.msgid.link/r/0-v1-3fbaef094271+2cf-rdma_op_ip_rslv_syz_jgg@nv… Cc: stable(a)vger.kernel.org Fixes: ae43f8286730 ("IB/core: Add IP to GID netlink offload") Reported-by: syzbot+938fcd548c303fe33c1a(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68dc3dac.a00a0220.102ee.004f.GAE@google.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/infiniband/core/addr.c | 33 ++++++++++----------------------- 1 file changed, 10 insertions(+), 23 deletions(-) diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c index f20dfe70f..0b58349b7 100644 --- a/drivers/infiniband/core/addr.c +++ b/drivers/infiniband/core/addr.c @@ -80,37 +80,25 @@ static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = { .min = sizeof(struct rdma_nla_ls_gid)}, }; -static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh) +static void ib_nl_process_ip_rsep(const struct nlmsghdr *nlh) { struct nlattr *tb[LS_NLA_TYPE_MAX] = {}; + union ib_gid gid; + struct addr_req *req; + int found = 0; int ret; if (nlh->nlmsg_flags & RDMA_NL_LS_F_ERR) - return false; + return; ret = nla_parse_deprecated(tb, LS_NLA_TYPE_MAX - 1, nlmsg_data(nlh), nlmsg_len(nlh), ib_nl_addr_policy, NULL); if (ret) - return false; - - return true; -} - -static void ib_nl_process_good_ip_rsep(const struct nlmsghdr *nlh) -{ - const struct nlattr *head, *curr; - union ib_gid gid; - struct addr_req *req; - int len, rem; - int found = 0; - - head = (const struct nlattr *)nlmsg_data(nlh); - len = nlmsg_len(nlh); + return; - nla_for_each_attr(curr, head, len, rem) { - if (curr->nla_type == LS_NLA_TYPE_DGID) - memcpy(&gid, nla_data(curr), nla_len(curr)); - } + if (!tb[LS_NLA_TYPE_DGID]) + return; + memcpy(&gid, nla_data(tb[LS_NLA_TYPE_DGID]), sizeof(gid)); spin_lock_bh(&lock); list_for_each_entry(req, &req_list, list) { @@ -137,8 +125,7 @@ int ib_nl_handle_ip_res_resp(struct sk_buff *skb, !(NETLINK_CB(skb).sk)) return -EPERM; - if (ib_nl_is_good_ip_resp(nlh)) - ib_nl_process_good_ip_rsep(nlh); + ib_nl_process_ip_rsep(nlh); return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] fix CVE-2025-68768
by Li Xiasong 04 Feb '26

04 Feb '26

*** BLURB HERE *** Jakub Kicinski (2): inet: frags: add inet_frag_queue_flush() inet: frags: flush pending skbs in fqdir_pre_exit() include/net/inet_frag.h | 18 +++----------- include/net/ipv6_frag.h | 9 ++++--- net/ipv4/inet_fragment.c | 51 +++++++++++++++++++++++++++++++++++++--- net/ipv4/ip_fragment.c | 18 +++++++------- 4 files changed, 65 insertions(+), 31 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
by Li Xiasong 04 Feb '26

04 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 81c734dae203757fb3c9eee6f9896386940776bd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13513 CVE: CVE-2026-23003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull(). [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729 __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860 ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903 gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1 ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438 ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500 ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:318 [inline] ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core net/core/dev.c:6139 [inline] __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252 netif_receive_skb_internal net/core/dev.c:6338 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6397 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712 sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995 tun_alloc_skb drivers/net/tun.c:1461 [inline] tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Fixes: 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") Reported-by: syzbot+d4dda070f833dc5dc89a(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695e88b2.050a0220.1c677c.036d.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260107163109.4188620-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/ip6_tunnel.c [conflicts due to not merge 9990ddf47d41 ("net: tunnel: make skb_vlan_inet_prepare() return drop reasons").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index c70ff45649ad..8348b7e43c13 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -844,7 +844,7 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb, skb_reset_network_header(skb); - if (!pskb_inet_may_pull(skb)) { + if (!skb_vlan_inet_prepare(skb, true)) { DEV_STATS_INC(tunnel->dev, rx_length_errors); DEV_STATS_INC(tunnel->dev, rx_errors); goto drop; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/5] CVE-2026-23003
by Li Xiasong 04 Feb '26

04 Feb '26

*** BLURB HERE *** Eric Dumazet (2): geneve: fix header validation in geneve[6]_xmit_skb ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Gal Pressman (1): geneve: Fix incorrect inner network header offset when innerprotoinherit is set Phillip Potter (2): net: geneve: check skb is large enough for IPv4/IPv6 header net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb drivers/net/geneve.c | 6 ++++++ include/net/ip_tunnels.h | 34 ++++++++++++++++++++++++++++++++++ net/ipv6/ip6_tunnel.c | 2 +- 3 files changed, 41 insertions(+), 1 deletion(-) -- 2.34.1

2 6

[PATCH OLK-6.6] media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
by Liu Kai 04 Feb '26

04 Feb '26

From: Jeongjun Park <aha310510(a)gmail.com> stable inclusion from stable-v6.6.120 commit 4a54d8fcb093761e4c56eb211cf4e39bf8401fa1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13371 CVE: CVE-2025-68819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b91e6aafe8d356086cc621bc03e35ba2299e4788 upstream. rlen value is a user-controlled value, but dtv5100_i2c_msg() does not check the size of the rlen value. Therefore, if it is set to a value larger than sizeof(st->data), an out-of-bounds vuln occurs for st->data. Therefore, we need to add proper range checking to prevent this vuln. Fixes: 60688d5e6e6e ("V4L/DVB (8735): dtv5100: replace dummy frontend by zl10353") Cc: stable(a)vger.kernel.org Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/media/usb/dvb-usb/dtv5100.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/usb/dvb-usb/dtv5100.c b/drivers/media/usb/dvb-usb/dtv5100.c index 56c9d521a34a..ee8a76fb5cc1 100644 --- a/drivers/media/usb/dvb-usb/dtv5100.c +++ b/drivers/media/usb/dvb-usb/dtv5100.c @@ -55,6 +55,11 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, } index = (addr << 8) + wbuf[0]; + if (rlen > sizeof(st->data)) { + warn("rlen = %x is too big!\n", rlen); + return -EINVAL; + } + memcpy(st->data, rbuf, rlen); msleep(1); /* avoid I2C errors */ return usb_control_msg(d->udev, pipe, request, -- 2.34.1

2 1

[PATCH OLK-6.6] RDMA/cm: Fix leaking the multicast GID table reference
by Liu Kai 04 Feb '26

04 Feb '26

From: Jason Gunthorpe <jgg(a)nvidia.com> stable inclusion from stable-v6.6.120 commit c0acdee513239e1d6e1b490f56be0e6837dfd162 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13395 CVE: CVE-2025-71084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 57f3cb6c84159d12ba343574df2115fb18dd83ca upstream. If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr. This leaks a refcount and triggers a WARN: GID entry ref leak for dev syz1 index 2 ref=573 WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline] WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886 Destroy the ah_attr after canceling the work, it is safe to call this twice. Link: https://patch.msgid.link/r/0-v1-4285d070a6b2+20a-rdma_mc_gid_leak_syz_jgg@n… Cc: stable(a)vger.kernel.org Fixes: fe454dc31e84 ("RDMA/ucma: Fix use-after-free bug in ucma_create_uevent") Reported-by: syzbot+b0da83a6c0e2e2bddbd4(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68232e7b.050a0220.f2294.09f6.GAE@google.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index a5ceae2e075a..7db79ff3fa06 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -1993,6 +1993,7 @@ static void destroy_mc(struct rdma_id_private *id_priv, ib_sa_free_multicast(mc->sa_mc); if (rdma_protocol_roce(id_priv->id.device, id_priv->id.port_num)) { + struct rdma_cm_event *event = &mc->iboe_join.event; struct rdma_dev_addr *dev_addr = &id_priv->id.route.addr.dev_addr; struct net_device *ndev = NULL; @@ -2015,6 +2016,8 @@ static void destroy_mc(struct rdma_id_private *id_priv, dev_put(ndev); cancel_work_sync(&mc->iboe_join.work); + if (event->event == RDMA_CM_EVENT_MULTICAST_JOIN) + rdma_destroy_ah_attr(&event->param.ud.ah_attr); } kfree(mc); } -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/cm: Fix leaking the multicast GID table reference
by Liu Kai 04 Feb '26

04 Feb '26

From: Jason Gunthorpe <jgg(a)nvidia.com> stable inclusion from stable-v5.10.248 commit d5ce588a9552878859a4d44b70b724216c188a5f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13395 CVE: CVE-2025-71084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 57f3cb6c84159d12ba343574df2115fb18dd83ca upstream. If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr. This leaks a refcount and triggers a WARN: GID entry ref leak for dev syz1 index 2 ref=573 WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline] WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886 Destroy the ah_attr after canceling the work, it is safe to call this twice. Link: https://patch.msgid.link/r/0-v1-4285d070a6b2+20a-rdma_mc_gid_leak_syz_jgg@n… Cc: stable(a)vger.kernel.org Fixes: fe454dc31e84 ("RDMA/ucma: Fix use-after-free bug in ucma_create_uevent") Reported-by: syzbot+b0da83a6c0e2e2bddbd4(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68232e7b.050a0220.f2294.09f6.GAE@google.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index a203ee7b053b..483a37f9fa12 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -1841,6 +1841,7 @@ static void destroy_mc(struct rdma_id_private *id_priv, ib_sa_free_multicast(mc->sa_mc); if (rdma_protocol_roce(id_priv->id.device, id_priv->id.port_num)) { + struct rdma_cm_event *event = &mc->iboe_join.event; struct rdma_dev_addr *dev_addr = &id_priv->id.route.addr.dev_addr; struct net_device *ndev = NULL; @@ -1863,6 +1864,8 @@ static void destroy_mc(struct rdma_id_private *id_priv, dev_put(ndev); cancel_work_sync(&mc->iboe_join.work); + if (event->event == RDMA_CM_EVENT_MULTICAST_JOIN) + rdma_destroy_ah_attr(&event->param.ud.ah_attr); } kfree(mc); } -- 2.34.1

2 1

[PATCH OLK-5.10] media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
by Liu Kai 04 Feb '26

04 Feb '26

From: Jeongjun Park <aha310510(a)gmail.com> stable inclusion from stable-v5.10.248 commit c2c293ea7b61f12cdaad1e99a5b4efc58c88960a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13371 CVE: CVE-2025-68819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b91e6aafe8d356086cc621bc03e35ba2299e4788 upstream. rlen value is a user-controlled value, but dtv5100_i2c_msg() does not check the size of the rlen value. Therefore, if it is set to a value larger than sizeof(st->data), an out-of-bounds vuln occurs for st->data. Therefore, we need to add proper range checking to prevent this vuln. Fixes: 60688d5e6e6e ("V4L/DVB (8735): dtv5100: replace dummy frontend by zl10353") Cc: stable(a)vger.kernel.org Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/media/usb/dvb-usb/dtv5100.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/usb/dvb-usb/dtv5100.c b/drivers/media/usb/dvb-usb/dtv5100.c index 1c13e493322c..89b3a5a790d8 100644 --- a/drivers/media/usb/dvb-usb/dtv5100.c +++ b/drivers/media/usb/dvb-usb/dtv5100.c @@ -55,6 +55,11 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, } index = (addr << 8) + wbuf[0]; + if (rlen > sizeof(st->data)) { + warn("rlen = %x is too big!\n", rlen); + return -EINVAL; + } + memcpy(st->data, rbuf, rlen); msleep(1); /* avoid I2C errors */ return usb_control_msg(d->udev, pipe, request, -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 04 Feb '26

04 Feb '26

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 04 Feb '26

04 Feb '26

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 04 Feb '26

04 Feb '26

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 9

[PATCH OLK-6.6 0/2] CVE-2024-35808
by linan666＠huaweicloud.com 04 Feb '26

04 Feb '26

From: Li Nan <linan122(a)huawei.com> Li Nan (1): md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen Yu Kuai (1): md/dm-raid: don't call md_reap_sync_thread() directly drivers/md/dm-raid.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] crypto: lzo - Fix compression buffer overrun
by Zhao Yipeng 04 Feb '26

04 Feb '26

From: Herbert Xu <herbert(a)gondor.apana.org.au> mainline inclusion from mainline-v6.15-rc1 commit cc47f07234f72cbd8e2c973cdbf2a6730660a463 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9780 CVE: CVE-2025-38068 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides enough buffer space, disregarding the buffer length provided by the caller. Add a safe compression interface that checks for the end of buffer before each write. Use the safe interface in crypto/lzo. Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: lib/lzo/lzo1x_compress.c [The context conflict is due to the mainline commit 33fb626be08f3 and a10c9ede9913f not being merged.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- crypto/lzo-rle.c | 2 +- crypto/lzo.c | 2 +- include/linux/lzo.h | 8 +++ lib/lzo/Makefile | 2 +- lib/lzo/lzo1x_compress.c | 102 +++++++++++++++++++++++++--------- lib/lzo/lzo1x_compress_safe.c | 18 ++++++ 6 files changed, 106 insertions(+), 28 deletions(-) create mode 100644 lib/lzo/lzo1x_compress_safe.c diff --git a/crypto/lzo-rle.c b/crypto/lzo-rle.c index 0631d975bfac..0abc2d87f042 100644 --- a/crypto/lzo-rle.c +++ b/crypto/lzo-rle.c @@ -55,7 +55,7 @@ static int __lzorle_compress(const u8 *src, unsigned int slen, size_t tmp_len = *dlen; /* size_t(ulong) <-> uint on 64 bit */ int err; - err = lzorle1x_1_compress(src, slen, dst, &tmp_len, ctx); + err = lzorle1x_1_compress_safe(src, slen, dst, &tmp_len, ctx); if (err != LZO_E_OK) return -EINVAL; diff --git a/crypto/lzo.c b/crypto/lzo.c index ebda132dd22b..8338851c7406 100644 --- a/crypto/lzo.c +++ b/crypto/lzo.c @@ -55,7 +55,7 @@ static int __lzo_compress(const u8 *src, unsigned int slen, size_t tmp_len = *dlen; /* size_t(ulong) <-> uint on 64 bit */ int err; - err = lzo1x_1_compress(src, slen, dst, &tmp_len, ctx); + err = lzo1x_1_compress_safe(src, slen, dst, &tmp_len, ctx); if (err != LZO_E_OK) return -EINVAL; diff --git a/include/linux/lzo.h b/include/linux/lzo.h index e95c7d1092b2..4d30e3624acd 100644 --- a/include/linux/lzo.h +++ b/include/linux/lzo.h @@ -24,10 +24,18 @@ int lzo1x_1_compress(const unsigned char *src, size_t src_len, unsigned char *dst, size_t *dst_len, void *wrkmem); +/* Same as above but does not write more than dst_len to dst. */ +int lzo1x_1_compress_safe(const unsigned char *src, size_t src_len, + unsigned char *dst, size_t *dst_len, void *wrkmem); + /* This requires 'wrkmem' of size LZO1X_1_MEM_COMPRESS */ int lzorle1x_1_compress(const unsigned char *src, size_t src_len, unsigned char *dst, size_t *dst_len, void *wrkmem); +/* Same as above but does not write more than dst_len to dst. */ +int lzorle1x_1_compress_safe(const unsigned char *src, size_t src_len, + unsigned char *dst, size_t *dst_len, void *wrkmem); + /* safe decompression with overrun testing */ int lzo1x_decompress_safe(const unsigned char *src, size_t src_len, unsigned char *dst, size_t *dst_len); diff --git a/lib/lzo/Makefile b/lib/lzo/Makefile index 2f58fafbbddd..fc7b2b7ef4b2 100644 --- a/lib/lzo/Makefile +++ b/lib/lzo/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only -lzo_compress-objs := lzo1x_compress.o +lzo_compress-objs := lzo1x_compress.o lzo1x_compress_safe.o lzo_decompress-objs := lzo1x_decompress_safe.o obj-$(CONFIG_LZO_COMPRESS) += lzo_compress.o diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c index 8ad5ba2b86e2..469c143f7585 100644 --- a/lib/lzo/lzo1x_compress.c +++ b/lib/lzo/lzo1x_compress.c @@ -18,11 +18,22 @@ #include <linux/lzo.h> #include "lzodefs.h" -static noinline size_t -lzo1x_1_do_compress(const unsigned char *in, size_t in_len, - unsigned char *out, size_t *out_len, - size_t ti, void *wrkmem, signed char *state_offset, - const unsigned char bitstream_version) +#undef LZO_UNSAFE + +#ifndef LZO_SAFE +#define LZO_UNSAFE 1 +#define LZO_SAFE(name) name +#define HAVE_OP(x) 1 +#endif + +#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun + +static noinline int +LZO_SAFE(lzo1x_1_do_compress)(const unsigned char *in, size_t in_len, + unsigned char **out, unsigned char *op_end, + size_t *tp, void *wrkmem, + signed char *state_offset, + const unsigned char bitstream_version) { const unsigned char *ip; unsigned char *op; @@ -30,8 +41,9 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, const unsigned char * const ip_end = in + in_len - 20; const unsigned char *ii; lzo_dict_t * const dict = (lzo_dict_t *) wrkmem; + size_t ti = *tp; - op = out; + op = *out; ip = in; ii = ip; ip += ti < 4 ? 4 - ti : 0; @@ -118,25 +130,32 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, if (t != 0) { if (t <= 3) { op[*state_offset] |= t; + NEED_OP(4); COPY4(op, ii); op += t; } else if (t <= 16) { + NEED_OP(17); *op++ = (t - 3); COPY8(op, ii); COPY8(op + 8, ii + 8); op += t; } else { if (t <= 18) { + NEED_OP(1); *op++ = (t - 3); } else { size_t tt = t - 18; + NEED_OP(1); *op++ = 0; while (unlikely(tt > 255)) { tt -= 255; + NEED_OP(1); *op++ = 0; } + NEED_OP(1); *op++ = tt; } + NEED_OP(t); do { COPY8(op, ii); COPY8(op + 8, ii + 8); @@ -153,6 +172,7 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, if (unlikely(run_length)) { ip += run_length; run_length -= MIN_ZERO_RUN_LENGTH; + NEED_OP(4); put_unaligned_le32((run_length << 21) | 0xfffc18 | (run_length & 0x7), op); op += 4; @@ -245,10 +265,12 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, ip += m_len; if (m_len <= M2_MAX_LEN && m_off <= M2_MAX_OFFSET) { m_off -= 1; + NEED_OP(2); *op++ = (((m_len - 1) << 5) | ((m_off & 7) << 2)); *op++ = (m_off >> 3); } else if (m_off <= M3_MAX_OFFSET) { m_off -= 1; + NEED_OP(1); if (m_len <= M3_MAX_LEN) *op++ = (M3_MARKER | (m_len - 2)); else { @@ -256,14 +278,18 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, *op++ = M3_MARKER | 0; while (unlikely(m_len > 255)) { m_len -= 255; + NEED_OP(1); *op++ = 0; } + NEED_OP(1); *op++ = (m_len); } + NEED_OP(2); *op++ = (m_off << 2); *op++ = (m_off >> 6); } else { m_off -= 0x4000; + NEED_OP(1); if (m_len <= M4_MAX_LEN) *op++ = (M4_MARKER | ((m_off >> 11) & 8) | (m_len - 2)); @@ -284,11 +310,14 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, m_len -= M4_MAX_LEN; *op++ = (M4_MARKER | ((m_off >> 11) & 8)); while (unlikely(m_len > 255)) { + NEED_OP(1); m_len -= 255; *op++ = 0; } + NEED_OP(1); *op++ = (m_len); } + NEED_OP(2); *op++ = (m_off << 2); *op++ = (m_off >> 6); } @@ -297,14 +326,20 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, ii = ip; goto next; } - *out_len = op - out; - return in_end - (ii - ti); + *out = op; + *tp = in_end - (ii - ti); + return LZO_E_OK; + +output_overrun: + return LZO_E_OUTPUT_OVERRUN; } -int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, - unsigned char *out, size_t *out_len, - void *wrkmem, const unsigned char bitstream_version) +static int LZO_SAFE(lzogeneric1x_1_compress)( + const unsigned char *in, size_t in_len, + unsigned char *out, size_t *out_len, + void *wrkmem, const unsigned char bitstream_version) { + unsigned char * const op_end = out + *out_len; const unsigned char *ip = in; unsigned char *op = out; unsigned char *data_start; @@ -328,14 +363,18 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, while (l > 20) { size_t ll = l <= (m4_max_offset + 1) ? l : (m4_max_offset + 1); uintptr_t ll_end = (uintptr_t) ip + ll; + int err; + if ((ll_end + ((t + ll) >> 5)) <= ll_end) break; BUILD_BUG_ON(D_SIZE * sizeof(lzo_dict_t) > LZO1X_1_MEM_COMPRESS); memset(wrkmem, 0, D_SIZE * sizeof(lzo_dict_t)); - t = lzo1x_1_do_compress(ip, ll, op, out_len, t, wrkmem, - &state_offset, bitstream_version); + err = LZO_SAFE(lzo1x_1_do_compress)( + ip, ll, &op, op_end, &t, wrkmem, + &state_offset, bitstream_version); + if (err != LZO_E_OK) + return err; ip += ll; - op += *out_len; l -= ll; } t += l; @@ -344,20 +383,26 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, const unsigned char *ii = in + in_len - t; if (op == data_start && t <= 238) { + NEED_OP(1); *op++ = (17 + t); } else if (t <= 3) { op[state_offset] |= t; } else if (t <= 18) { + NEED_OP(1); *op++ = (t - 3); } else { size_t tt = t - 18; + NEED_OP(1); *op++ = 0; while (tt > 255) { tt -= 255; + NEED_OP(1); *op++ = 0; } + NEED_OP(1); *op++ = tt; } + NEED_OP(t); if (t >= 16) do { COPY8(op, ii); COPY8(op + 8, ii + 8); @@ -370,31 +415,38 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, } while (--t > 0); } + NEED_OP(3); *op++ = M4_MARKER | 1; *op++ = 0; *op++ = 0; *out_len = op - out; return LZO_E_OK; + +output_overrun: + return LZO_E_OUTPUT_OVERRUN; } -int lzo1x_1_compress(const unsigned char *in, size_t in_len, - unsigned char *out, size_t *out_len, - void *wrkmem) +int LZO_SAFE(lzo1x_1_compress)(const unsigned char *in, size_t in_len, + unsigned char *out, size_t *out_len, + void *wrkmem) { - return lzogeneric1x_1_compress(in, in_len, out, out_len, wrkmem, 0); + return LZO_SAFE(lzogeneric1x_1_compress)( + in, in_len, out, out_len, wrkmem, 0); } -int lzorle1x_1_compress(const unsigned char *in, size_t in_len, - unsigned char *out, size_t *out_len, - void *wrkmem) +int LZO_SAFE(lzorle1x_1_compress)(const unsigned char *in, size_t in_len, + unsigned char *out, size_t *out_len, + void *wrkmem) { - return lzogeneric1x_1_compress(in, in_len, out, out_len, - wrkmem, LZO_VERSION); + return LZO_SAFE(lzogeneric1x_1_compress)( + in, in_len, out, out_len, wrkmem, LZO_VERSION); } -EXPORT_SYMBOL_GPL(lzo1x_1_compress); -EXPORT_SYMBOL_GPL(lzorle1x_1_compress); +EXPORT_SYMBOL_GPL(LZO_SAFE(lzo1x_1_compress)); +EXPORT_SYMBOL_GPL(LZO_SAFE(lzorle1x_1_compress)); +#ifndef LZO_UNSAFE MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("LZO1X-1 Compressor"); +#endif diff --git a/lib/lzo/lzo1x_compress_safe.c b/lib/lzo/lzo1x_compress_safe.c new file mode 100644 index 000000000000..371c9f849492 --- /dev/null +++ b/lib/lzo/lzo1x_compress_safe.c @@ -0,0 +1,18 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * LZO1X Compressor from LZO + * + * Copyright (C) 1996-2012 Markus F.X.J. Oberhumer <markus(a)oberhumer.com> + * + * The full LZO package can be found at: + * http://www.oberhumer.com/opensource/lzo/ + * + * Changed for Linux kernel use by: + * Nitin Gupta <nitingupta910(a)gmail.com> + * Richard Purdie <rpurdie(a)openedhand.com> + */ + +#define LZO_SAFE(name) name##_safe +#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x)) + +#include "lzo1x_compress.c" -- 2.34.1

2 1

[PATCH v12 00/13] arm64: entry: Convert to Generic Entry
by Jinjie Ruan 03 Feb '26

03 Feb '26

Currently, x86, Riscv, Loongarch use the Generic Entry which makes maintainers' work easier and codes more elegant. arm64 has already successfully switched to the Generic IRQ Entry in commit b3cf07851b6c ("arm64: entry: Switch to generic IRQ entry"), it is time to completely convert arm64 to Generic Entry. The goal is to bring arm64 in line with other architectures that already use the generic entry infrastructure, reducing duplicated code and making it easier to share future changes in entry/exit paths, such as "Syscall User Dispatch". This patch set is rebased on "sched/core". And the performance was measured on Kunpeng 920 using "perf bench basic syscall" with "arm64.nopauth selinux=0 audit=1". On the basis of optimizing syscall_get_arguments()[1], el0_svc_common(), the performance are below: | Metric | W/O Generic Entry | With Generic Entry opt| Change | | ---------- | ----------------- | ------------------ | ------ | | Total time | 2.487 [sec] | 2.264 [sec] | ↓9.0% | | usecs/op | 0.248780 | 0.226481 | ↓9.0% | | ops/sec | 4,019,620 | 4,415,383 | ↑9.8% | Therefore, after the optimization, ARM64 System Call performance improved by approximately 9%. It was tested ok with following test cases on kunpeng920 and QEMU virt platform: - Perf tests. - Different `dynamic preempt` mode switch. - Pseudo NMI tests. - Stress-ng CPU stress test. - Hackbench stress test. - MTE test case in Documentation/arch/arm64/memory-tagging-extension.rst and all test cases in tools/testing/selftests/arm64/mte/*. - "sud" selftest testcase. - get_set_sud, get_syscall_info, set_syscall_info, peeksiginfo in tools/testing/selftests/ptrace. - breakpoint_test_arm64 in selftests/breakpoints. - syscall-abi and ptrace in tools/testing/selftests/arm64/abi - fp-ptrace, sve-ptrace, za-ptrace in selftests/arm64/fp. - vdso_test_getrandom in tools/testing/selftests/vDSO - Strace tests. The test QEMU configuration is as follows: qemu-system-aarch64 \ -M virt,gic-version=3,virtualization=on,mte=on \ -cpu max,pauth-impdef=on \ -kernel Image \ -smp 8,sockets=1,cores=4,threads=2 \ -m 512m \ -nographic \ -no-reboot \ -device virtio-rng-pci \ -append "root=/dev/vda rw console=ttyAMA0 kgdboc=ttyAMA0,115200 \ earlycon preempt=voluntary irqchip.gicv3_pseudo_nmi=1" \ -drive if=none,file=images/rootfs.ext4,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 \ [1]: https://kernel.googlesource.com/pub/scm/linux/kernel/git/akpm/mm/+/89bf683c… Changes in v12: - Rebased on "sched/core", so remove the four generic entry patches. - Move "Expand secure_computing() in place" and "Use syscall_get_arguments() helper" patch forward, which will group all non-functional cleanups at the front. - Adjust the explanation for moving rseq_syscall() before audit_syscall_exit(). - Link to v11: https://lore.kernel.org/all/20260128031934.3906955-1-ruanjinjie@huawei.com/ Changes in v11: - Remove unused syscall in syscall_trace_enter(). - Update and provide a detailed explanation of the differences after moving rseq_syscall() before audit_syscall_exit(). - Rebased on arm64 (for-next/entry), and remove the first applied 3 patchs. - syscall_exit_to_user_mode_work() for arch reuse instead of adding new syscall_exit_to_user_mode_work_prepare() helper. - Link to v10: https://lore.kernel.org/all/20251222114737.1334364-1-ruanjinjie@huawei.com/ Changes in v10: - Rebased on v6.19-rc1, rename syscall_exit_to_user_mode_prepare() to syscall_exit_to_user_mode_work_prepare() to avoid conflict. - Also inline syscall_trace_enter(). - Support aarch64 for sud_benchmark. - Update and correct the commit message. - Add Reviewed-by. - Link to v9: https://lore.kernel.org/all/20251204082123.2792067-1-ruanjinjie@huawei.com/ Changes in v9: - Move "Return early for ptrace_report_syscall_entry() error" patch ahead to make it not introduce a regression. - Not check _TIF_SECCOMP/SYSCALL_EMU for syscall_exit_work() in a separate patch. - Do not report_syscall_exit() for PTRACE_SYSEMU_SINGLESTEP in a separate patch. - Add two performance patch to improve the arm64 performance. - Add Reviewed-by. - Link to v8: https://lore.kernel.org/all/20251126071446.3234218-1-ruanjinjie@huawei.com/ Changes in v8: - Rename "report_syscall_enter()" to "report_syscall_entry()". - Add ptrace_save_reg() to avoid duplication. - Remove unused _TIF_WORK_MASK in a standalone patch. - Align syscall_trace_enter() return value with the generic version. - Use "scno" instead of regs->syscallno in el0_svc_common(). - Move rseq_syscall() ahead in a standalone patch to clarify it clearly. - Rename "syscall_trace_exit()" to "syscall_exit_work()". - Keep the goto in el0_svc_common(). - No argument was passed to __secure_computing() and check -1 not -1L. - Remove "Add has_syscall_work() helper" patch. - Move "Add syscall_exit_to_user_mode_prepare() helper" patch later. - Add miss header for asm/entry-common.h. - Update the implementation of arch_syscall_is_vdso_sigreturn(). - Add "ARCH_SYSCALL_WORK_EXIT" to be defined as "SECCOMP | SYSCALL_EMU" to keep the behaviour unchanged. - Add more testcases test. - Add Reviewed-by. - Update the commit message. - Link to v7: https://lore.kernel.org/all/20251117133048.53182-1-ruanjinjie@huawei.com/ Jinjie Ruan (12): arm64: Remove unused _TIF_WORK_MASK arm64/ptrace: Split report_syscall() arm64/ptrace: Return early for ptrace_report_syscall_entry() error arm64/ptrace: Refactor syscall_trace_enter/exit() arm64/ptrace: Expand secure_computing() in place arm64/ptrace: Use syscall_get_arguments() helper arm64: ptrace: Move rseq_syscall() before audit_syscall_exit() arm64: syscall: Rework el0_svc_common() arm64/ptrace: Not check _TIF_SECCOMP/SYSCALL_EMU for syscall_exit_work() arm64/ptrace: Do not report_syscall_exit() for PTRACE_SYSEMU_SINGLESTEP arm64: entry: Convert to generic entry arm64: Inline el0_svc_common() kemal (1): selftests: sud_test: Support aarch64 arch/arm64/Kconfig | 2 +- arch/arm64/include/asm/entry-common.h | 76 +++++++++++++++ arch/arm64/include/asm/syscall.h | 19 +++- arch/arm64/include/asm/thread_info.h | 22 +---- arch/arm64/kernel/debug-monitors.c | 7 ++ arch/arm64/kernel/ptrace.c | 94 ------------------- arch/arm64/kernel/signal.c | 2 +- arch/arm64/kernel/syscall.c | 29 ++---- .../syscall_user_dispatch/sud_benchmark.c | 2 +- .../syscall_user_dispatch/sud_test.c | 4 + 10 files changed, 115 insertions(+), 142 deletions(-) -- 2.34.1

1 13

[PATCH OLK-6.6] LoongArch: BPF: Sign extend kfunc call arguments
by Lin Yujun 03 Feb '26

03 Feb '26

From: Hengqi Chen <hengqi.chen(a)gmail.com> stable inclusion from stable-v6.6.120 commit fd43edf357a3a1f5ed1c4bf450b60001c9091c39 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13443 CVE: CVE-2025-71129 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3f5a238f24d7b75f9efe324d3539ad388f58536e upstream. The kfunc calls are native calls so they should follow LoongArch calling conventions. Sign extend its arguments properly to avoid kernel panic. This is done by adding a new emit_abi_ext() helper. The emit_abi_ext() helper performs extension in place meaning a value already store in the target register (Note: this is different from the existing sign_extend() helper and thus we can't reuse it). Cc: stable(a)vger.kernel.org Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Signed-off-by: Hengqi Chen <hengqi.chen(a)gmail.com> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/loongarch/net/bpf_jit.c | 16 ++++++++++++++++ arch/loongarch/net/bpf_jit.h | 26 ++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index c6d4f2200cc1..2258624a3247 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -830,10 +830,26 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass, &func_addr, &func_addr_fixed); if (ret < 0) return ret; + if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) { + const struct btf_func_model *m; + int i; + + m = bpf_jit_find_kfunc_model(ctx->prog, insn); + if (!m) + return -EINVAL; + + for (i = 0; i < m->nr_args; i++) { + u8 reg = regmap[BPF_REG_1 + i]; + bool sign = m->arg_flags[i] & BTF_FMODEL_SIGNED_ARG; + + emit_abi_ext(ctx, reg, m->arg_size[i], sign); + } + } + move_addr(ctx, t1, func_addr); emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0); if (insn->src_reg != BPF_PSEUDO_CALL) move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h index f9c569f53949..9352ea554530 100644 --- a/arch/loongarch/net/bpf_jit.h +++ b/arch/loongarch/net/bpf_jit.h @@ -85,10 +85,36 @@ static inline void emit_sext_32(struct jit_ctx *ctx, enum loongarch_gpr reg, boo return; emit_insn(ctx, addiw, reg, reg, 0); } +/* Emit proper extension according to ABI requirements. + * Note that it requires a value of size `size` already resides in register `reg`. + */ +static inline void emit_abi_ext(struct jit_ctx *ctx, int reg, u8 size, bool sign) +{ + /* ABI requires unsigned char/short to be zero-extended */ + if (!sign && (size == 1 || size == 2)) + return; + + switch (size) { + case 1: + emit_insn(ctx, extwb, reg, reg); + break; + case 2: + emit_insn(ctx, extwh, reg, reg); + break; + case 4: + emit_insn(ctx, addiw, reg, reg, 0); + break; + case 8: + break; + default: + pr_warn("bpf_jit: invalid size %d for extension\n", size); + } +} + static inline void move_addr(struct jit_ctx *ctx, enum loongarch_gpr rd, u64 addr) { u64 imm_11_0, imm_31_12, imm_51_32, imm_63_52; /* lu12iw rd, imm_31_12 */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] *** fix CVE-2025-38062 ***
by Lin Ruifeng 03 Feb '26

03 Feb '26

*** fix CVE-2025-38062 *** Jason Gunthorpe (1): genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie Lin Ruifeng (1): genirq/msi:: Fix kabi break of struct msi_desc drivers/iommu/dma-iommu.c | 28 +++++++++++++--------------- include/linux/msi.h | 35 +++++++++++++++-------------------- 2 files changed, 28 insertions(+), 35 deletions(-) -- 2.43.0

2 3

[PATCH openEuler-1.0-LTS] dm flakey: don't corrupt the zero page
by Yuan can 03 Feb '26

03 Feb '26

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.276 commit 98e311be44dbe31ad9c42aa067b2359bac451fda category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13114 CVE: CVE-2023-54317 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f50714b57aecb6b3dc81d578e295f86d9c73f078 upstream. When we need to zero some range on a block device, the function __blkdev_issue_zero_pages submits a write bio with the bio vector pointing to the zero page. If we use dm-flakey with corrupt bio writes option, it will corrupt the content of the zero page which results in crashes of various userspace programs. Glibc assumes that memory returned by mmap is zeroed and it uses it for calloc implementation; if the newly mapped memory is not zeroed, calloc will return non-zeroed memory. Fix this bug by testing if the page is equal to ZERO_PAGE(0) and avoiding the corruption in this case. Cc: stable(a)vger.kernel.org Fixes: a00f5276e266 ("dm flakey: Properly corrupt multi-page bios.") Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/md/dm-flakey.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c index 9a955b8cf378..6a8c7ec21219 100644 --- a/drivers/md/dm-flakey.c +++ b/drivers/md/dm-flakey.c @@ -299,12 +299,15 @@ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) * Overwrite the Nth byte of the bio's data, on whichever page * it falls. */ bio_for_each_segment(bvec, bio, iter) { if (bio_iter_len(bio, iter) > corrupt_bio_byte) { - char *segment = (page_address(bio_iter_page(bio, iter)) - + bio_iter_offset(bio, iter)); + char *segment; + struct page *page = bio_iter_page(bio, iter); + if (unlikely(page == ZERO_PAGE(0))) + break; + segment = (page_address(page) + bio_iter_offset(bio, iter)); segment[corrupt_bio_byte] = fc->corrupt_bio_value; DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, -- 2.34.1

2 1

[PATCH OLK-5.10] atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
by Lin Ruifeng 03 Feb '26

03 Feb '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> stable inclusion from stable-v5.10.242 commit 0a6a6d4fb333f7afe22e59ffed18511a7a98efc8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12387 CVE: CVE-2025-39828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ec79003c5f9d2c7f9576fc69b8dbda80305cbe3a ] syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 </TASK> Modules linked in: Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+1741b56d54536f4ec349(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68a6767c.050a0220.3d78fd.0011.GAE@google.com/ Tested-by: syzbot+1741b56d54536f4ec349(a)syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20250821021901.2814721-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/atm/atmtcp.c net/atm/common.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/atm/atmtcp.c | 14 ++++++++++++++ include/linux/atmdev.h | 1 + net/atm/common.c | 13 +++++++++++-- 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c index 96bea1ab1ecc..df2b47472de4 100644 --- a/drivers/atm/atmtcp.c +++ b/drivers/atm/atmtcp.c @@ -279,6 +279,19 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci) return NULL; } +static int atmtcp_c_pre_send(struct atm_vcc *vcc, struct sk_buff *skb) +{ + struct atmtcp_hdr *hdr; + + if (skb->len < sizeof(struct atmtcp_hdr)) + return -EINVAL; + + hdr = (struct atmtcp_hdr *)skb->data; + if (hdr->length == ATMTCP_HDR_MAGIC) + return -EINVAL; + + return 0; +} static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb) { @@ -345,6 +358,7 @@ static const struct atmdev_ops atmtcp_v_dev_ops = { static const struct atmdev_ops atmtcp_c_dev_ops = { .close = atmtcp_c_close, + .pre_send = atmtcp_c_pre_send, .send = atmtcp_c_send }; diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h index 5d5ff2203fa2..cedf880259d3 100644 --- a/include/linux/atmdev.h +++ b/include/linux/atmdev.h @@ -185,6 +185,7 @@ struct atmdev_ops { /* only send is required */ int (*compat_ioctl)(struct atm_dev *dev,unsigned int cmd, void __user *arg); #endif + int (*pre_send)(struct atm_vcc *vcc, struct sk_buff *skb); int (*send)(struct atm_vcc *vcc,struct sk_buff *skb); int (*send_oam)(struct atm_vcc *vcc,void *cell,int flags); void (*phy_put)(struct atm_dev *dev,unsigned char value, diff --git a/net/atm/common.c b/net/atm/common.c index 1cfa9bf1d187..cb153d6e6745 100644 --- a/net/atm/common.c +++ b/net/atm/common.c @@ -635,17 +635,26 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) skb->dev = NULL; /* for paths shared with net_device interfaces */ if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) { - kfree_skb(skb); error = -EFAULT; - goto out; + goto free_skb; } if (eff != size) memset(skb->data + size, 0, eff-size); + + if (vcc->dev->ops->pre_send) { + error = vcc->dev->ops->pre_send(vcc, skb); + if (error) + goto free_skb; + } + error = vcc->dev->ops->send(vcc, skb); error = error ? error : size; out: release_sock(sk); return error; +free_skb: + kfree_skb(skb); + goto out; } __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait) -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] *** fix CVE-2025-38062 ***
by Lin Ruifeng 03 Feb '26

03 Feb '26

*** fix CVE-2025-38062 *** Jason Gunthorpe (1): genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie Lin Ruifeng (1): genirq/msi:: Fix kabi break of struct msi_desc drivers/iommu/dma-iommu.c | 28 +++++++++++++--------------- include/linux/msi.h | 35 +++++++++++++++-------------------- 2 files changed, 28 insertions(+), 35 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] iommu/s390: Implement blocking domain
by Lin Ruifeng 03 Feb '26

03 Feb '26

From: Matthew Rosato <mjrosato(a)linux.ibm.com> mainline inclusion from mainline-v6.13-rc1 commit ecda483339a5151e3ca30d6b82691ef6f1d17912 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/1633 CVE: CVE-2024-53232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------------------------------------------- This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device. Fixes: c76c067e488c ("s390/pci: Use dma-iommu layer") Co-developed-by: Niklas Schnelle <schnelle(a)linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle(a)linux.ibm.com> Signed-off-by: Matthew Rosato <mjrosato(a)linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle(a)linux.ibm.com> Reviewed-by: Jason Gunthorpe <jgg(a)nvidia.com> Link: https://lore.kernel.org/r/20240910211516.137933-1-mjrosato@linux.ibm.com Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Conflicts: drivers/iommu/s390-iommu.c arch/s390/pci/pci.c [Some context differences] Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- arch/s390/include/asm/pci.h | 4 +- arch/s390/pci/pci_debug.c | 10 ++++- drivers/iommu/s390-iommu.c | 73 +++++++++++++++++++++++-------------- 3 files changed, 56 insertions(+), 31 deletions(-) diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h index 3f74f1cf37df..e0fae2739994 100644 --- a/arch/s390/include/asm/pci.h +++ b/arch/s390/include/asm/pci.h @@ -96,7 +96,6 @@ struct zpci_bar_struct { u8 size; /* order 2 exponent */ }; -struct s390_domain; struct kvm_zdev; #define ZPCI_FUNCTIONS_PER_BUS 256 @@ -184,9 +183,10 @@ struct zpci_dev { struct dentry *debugfs_dev; /* IOMMU and passthrough */ - struct s390_domain *s390_domain; /* s390 IOMMU domain data */ + struct iommu_domain *s390_domain; /* attached IOMMU domain */ struct kvm_zdev *kzdev; struct mutex kzdev_lock; + spinlock_t dom_lock; /* protect s390_domain change */ }; static inline bool zdev_enabled(struct zpci_dev *zdev) diff --git a/arch/s390/pci/pci_debug.c b/arch/s390/pci/pci_debug.c index 6dde2263c79d..ac4d172f2740 100644 --- a/arch/s390/pci/pci_debug.c +++ b/arch/s390/pci/pci_debug.c @@ -71,17 +71,23 @@ static void pci_fmb_show(struct seq_file *m, char *name[], int length, static void pci_sw_counter_show(struct seq_file *m) { - struct zpci_iommu_ctrs *ctrs = zpci_get_iommu_ctrs(m->private); + struct zpci_dev *zdev = m->private; + struct zpci_iommu_ctrs *ctrs; atomic64_t *counter; + unsigned long flags; int i; + spin_lock_irqsave(&zdev->dom_lock, flags); + ctrs = zpci_get_iommu_ctrs(m->private); if (!ctrs) - return; + goto unlock; counter = &ctrs->mapped_pages; for (i = 0; i < ARRAY_SIZE(pci_sw_names); i++, counter++) seq_printf(m, "%26s:\t%llu\n", pci_sw_names[i], atomic64_read(counter)); +unlock: + spin_unlock_irqrestore(&zdev->dom_lock, flags); } static int pci_perf_show(struct seq_file *m, void *v) diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c index 9a5196f523de..db9fc74f9027 100644 --- a/drivers/iommu/s390-iommu.c +++ b/drivers/iommu/s390-iommu.c @@ -33,6 +33,8 @@ struct s390_domain { struct rcu_head rcu; }; +static struct iommu_domain blocking_domain; + static inline unsigned int calc_rtx(dma_addr_t ptr) { return ((unsigned long)ptr >> ZPCI_RT_SHIFT) & ZPCI_INDEX_MASK; @@ -369,20 +371,36 @@ static void s390_domain_free(struct iommu_domain *domain) call_rcu(&s390_domain->rcu, s390_iommu_rcu_free_domain); } -static void s390_iommu_detach_device(struct iommu_domain *domain, - struct device *dev) +static void zdev_s390_domain_update(struct zpci_dev *zdev, + struct iommu_domain *domain) +{ + unsigned long flags; + + spin_lock_irqsave(&zdev->dom_lock, flags); + zdev->s390_domain = domain; + spin_unlock_irqrestore(&zdev->dom_lock, flags); +} + +static int blocking_domain_attach_device(struct iommu_domain *domain, + struct device *dev) { - struct s390_domain *s390_domain = to_s390_domain(domain); struct zpci_dev *zdev = to_zpci_dev(dev); + struct s390_domain *s390_domain; unsigned long flags; + if (zdev->s390_domain->type == IOMMU_DOMAIN_BLOCKED) + return 0; + + s390_domain = to_s390_domain(zdev->s390_domain); spin_lock_irqsave(&s390_domain->list_lock, flags); list_del_rcu(&zdev->iommu_list); spin_unlock_irqrestore(&s390_domain->list_lock, flags); zpci_unregister_ioat(zdev, 0); - zdev->s390_domain = NULL; zdev->dma_table = NULL; + zdev_s390_domain_update(zdev, domain); + + return 0; } static int s390_iommu_attach_device(struct iommu_domain *domain, @@ -401,20 +419,15 @@ static int s390_iommu_attach_device(struct iommu_domain *domain, domain->geometry.aperture_end < zdev->start_dma)) return -EINVAL; - if (zdev->s390_domain) - s390_iommu_detach_device(&zdev->s390_domain->domain, dev); + blocking_domain_attach_device(&blocking_domain, dev); + /* If we fail now DMA remains blocked via blocking domain */ cc = zpci_register_ioat(zdev, 0, zdev->start_dma, zdev->end_dma, virt_to_phys(s390_domain->dma_table), &status); - /* - * If the device is undergoing error recovery the reset code - * will re-establish the new domain. - */ if (cc && status != ZPCI_PCI_ST_FUNC_NOT_AVAIL) return -EIO; - zdev->dma_table = s390_domain->dma_table; - zdev->s390_domain = s390_domain; + zdev_s390_domain_update(zdev, domain); spin_lock_irqsave(&s390_domain->list_lock, flags); list_add_rcu(&zdev->iommu_list, &s390_domain->devices); @@ -466,19 +479,11 @@ static struct iommu_device *s390_iommu_probe_device(struct device *dev) if (zdev->tlb_refresh) dev->iommu->shadow_on_flush = 1; - return &zdev->iommu_dev; -} + /* Start with DMA blocked */ + spin_lock_init(&zdev->dom_lock); + zdev_s390_domain_update(zdev, &blocking_domain); -static void s390_iommu_release_device(struct device *dev) -{ - struct zpci_dev *zdev = to_zpci_dev(dev); - - /* - * release_device is expected to detach any domain currently attached - * to the device, but keep it attached to other devices in the group. - */ - if (zdev) - s390_iommu_detach_device(&zdev->s390_domain->domain, dev); + return &zdev->iommu_dev; } static int zpci_refresh_all(struct zpci_dev *zdev) @@ -702,9 +707,15 @@ static void s390_iommu_probe_finalize(struct device *dev) struct zpci_iommu_ctrs *zpci_get_iommu_ctrs(struct zpci_dev *zdev) { - if (!zdev || !zdev->s390_domain) + struct s390_domain *s390_domain; + + lockdep_assert_held(&zdev->dom_lock); + + if (zdev->s390_domain->type == IOMMU_DOMAIN_BLOCKED) return NULL; - return &zdev->s390_domain->ctrs; + + s390_domain = to_s390_domain(zdev->s390_domain); + return &s390_domain->ctrs; } int zpci_init_iommu(struct zpci_dev *zdev) @@ -781,12 +792,20 @@ static int __init s390_iommu_init(void) } subsys_initcall(s390_iommu_init); +static struct iommu_domain blocking_domain = { + .type = IOMMU_DOMAIN_BLOCKED, + .ops = &(const struct iommu_domain_ops) { + .attach_dev = blocking_domain_attach_device, + } +}; + static const struct iommu_ops s390_iommu_ops = { + .blocked_domain = &blocking_domain, + .release_domain = &blocking_domain, .capable = s390_iommu_capable, .domain_alloc_paging = s390_domain_alloc_paging, .probe_device = s390_iommu_probe_device, .probe_finalize = s390_iommu_probe_finalize, - .release_device = s390_iommu_release_device, .device_group = generic_device_group, .pgsize_bitmap = SZ_4K, .get_resv_regions = s390_iommu_get_resv_regions, -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-68785
by Zhao Yipeng 03 Feb '26

03 Feb '26

Patch #1 is the prerequisite patch, and Patch #2 fixes CVE-2025-68785. Ilya Maximets (2): net: openvswitch: remove never-working support for setting nsh fields net: openvswitch: fix middle attribute validation in push_nsh() action net/openvswitch/actions.c | 68 +------------------------------- net/openvswitch/flow_netlink.c | 71 +++++++--------------------------- net/openvswitch/flow_netlink.h | 2 - 3 files changed, 16 insertions(+), 125 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v4 00/13] net: LTS-6.6 backport
by Dong Chenchen 03 Feb '26

03 Feb '26

net LTS-6.6 patches backport Aakash Kumar S (1): xfrm: Duplicate SPI Handling Bui Quang Minh (1): virtio-net: fix received length check in big packets Florian Westphal (1): netfilter: nf_reject: don't leak dst refcount for loopback packets Jakub Kicinski (3): tls: handle data disappearing from under the TLS ULP tls: make sure to abort the stream if headers are bogus page_pool: always add GFP_NOWARN for ATOMIC allocations Jiayuan Chen (1): bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls Kuniyuki Iwashima (1): Bluetooth: hci_core: Fix use-after-free in vhci_flush() Maher Azzouzi (1): net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing Michal Luczaj (1): vsock: Ignore signal/timeout on connect() if already established Nikolay Aleksandrov (1): net: bridge: fix use-after-free due to MST port state bypass Nishanth Menon (1): net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Sabrina Dubroca (1): xfrm: xfrm_alloc_spi shouldn't use 0 as SPI drivers/net/ethernet/ti/netcp_core.c | 10 ++-- drivers/net/virtio_net.c | 25 +++++----- drivers/soc/ti/knav_dma.c | 14 +++--- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_core.c | 34 +++++++++++-- net/bridge/br_forward.c | 2 +- net/bridge/br_input.c | 4 +- net/bridge/br_private.h | 8 +-- net/core/page_pool.c | 6 +++ net/ipv4/netfilter/nf_reject_ipv4.c | 6 +-- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +- net/sched/sch_mqprio.c | 2 +- net/tls/tls.h | 3 +- net/tls/tls_strp.c | 25 +++++++--- net/tls/tls_sw.c | 19 +++++-- net/vmw_vsock/af_vsock.c | 40 +++++++++++---- net/xfrm/xfrm_state.c | 75 +++++++++++++++++----------- 17 files changed, 186 insertions(+), 93 deletions(-) -- 2.25.1

2 14

[PATCH OLK-6.6 0/2] Fix NFS deadlock
by Li Lingfeng 03 Feb '26

03 Feb '26

Revert the patch from hulk and apply the one from mainline. Trond Myklebust (1): NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong (1): Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" fs/nfs/file.c | 11 +++++++++-- fs/nfs/nfstrace.h | 3 +++ fs/nfs/write.c | 33 +++++++++++++++++++++++++++++++++ include/linux/nfs_fs.h | 1 + 4 files changed, 46 insertions(+), 2 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Deepakkumar Karn <dkarn(a)redhat.com> stable inclusion from stable-v6.6.120 commit 4bd4ea3eb326608ffc296db12c105f92dc2f2190 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13480 CVE: CVE-2025-71154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12cab1191d9890097171156d06bfa8d31f1e39c8 ] In async_set_registers(), when usb_submit_urb() fails, the allocated async_req structure and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked. Fix this by freeing both the URB and the request structure in the error path when usb_submit_urb() fails. Reported-by: syzbot+8dd915c7cb0490fc8c52(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8dd915c7cb0490fc8c52 Fixes: 4d12997a9bb3 ("drivers: net: usb: rtl8150: concurrent URB bugfix") Signed-off-by: Deepakkumar Karn <dkarn(a)redhat.com> Link: https://patch.msgid.link/20251216151304.59865-2-dkarn@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/net/usb/rtl8150.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index 92add3daadbb..f840fc374a29 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -211,6 +211,8 @@ static int async_set_registers(rtl8150_t *dev, u16 indx, u16 size, u16 reg) if (res == -ENODEV) netif_device_detach(dev->netdev); dev_err(&dev->udev->dev, "%s failed with %d\n", __func__, res); + kfree(req); + usb_free_urb(async_urb); } return res; } -- 2.43.0

2 1

[PATCH OLK-6.6] wifi: avoid kernel-infoleak from struct iw_point
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.121 commit d21ec867d84c9f3a9845d7d8c90c9ce35dbe48f8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13487 CVE: CVE-2026-22978 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 21cbf883d073abbfe09e3924466aa5e0449e7261 upstream. struct iw_point has a 32bit hole on 64bit arches. struct iw_point { void __user *pointer; /* Pointer to the data (in user space) */ __u16 length; /* number of fields or size in bytes */ __u16 flags; /* Optional params */ }; Make sure to zero the structure to avoid disclosing 32bits of kernel data to user space. Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c") Reported-by: syzbot+bfc7323743ca6dbcc3d3(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/wireless/wext-core.c | 4 ++++ net/wireless/wext-priv.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c index 838ad6541a17..73a29ee3eff2 100644 --- a/net/wireless/wext-core.c +++ b/net/wireless/wext-core.c @@ -1103,6 +1103,10 @@ static int compat_standard_call(struct net_device *dev, return ioctl_standard_call(dev, iwr, cmd, info, handler); iwp_compat = (struct compat_iw_point *) &iwr->u.data; + + /* struct iw_point has a 32bit hole on 64bit arches. */ + memset(&iwp, 0, sizeof(iwp)); + iwp.pointer = compat_ptr(iwp_compat->pointer); iwp.length = iwp_compat->length; iwp.flags = iwp_compat->flags; diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c index 674d426a9d24..37d1147019c2 100644 --- a/net/wireless/wext-priv.c +++ b/net/wireless/wext-priv.c @@ -228,6 +228,10 @@ int compat_private_call(struct net_device *dev, struct iwreq *iwr, struct iw_point iwp; iwp_compat = (struct compat_iw_point *) &iwr->u.data; + + /* struct iw_point has a 32bit hole on 64bit arches. */ + memset(&iwp, 0, sizeof(iwp)); + iwp.pointer = compat_ptr(iwp_compat->pointer); iwp.length = iwp_compat->length; iwp.flags = iwp_compat->flags; -- 2.43.0

2 1

[PATCH OLK-6.6] mm/secretmem: fix use-after-free race in fault handler
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Lance Yang <lance.yang(a)linux.dev> stable inclusion from stable-v6.6.117 commit 42d486d35a4143cc37fc72ee66edc99d942dd367 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11252 CVE: CVE-2025-40272 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6f86d0534fddfbd08687fa0f01479d4226bc3c3d upstream. When a page fault occurs in a secret memory file created with `memfd_secret(2)`, the kernel will allocate a new folio for it, mark the underlying page as not-present in the direct map, and add it to the file mapping. If two tasks cause a fault in the same page concurrently, both could end up allocating a folio and removing the page from the direct map, but only one would succeed in adding the folio to the file mapping. The task that failed undoes the effects of its attempt by (a) freeing the folio again and (b) putting the page back into the direct map. However, by doing these two operations in this order, the page becomes available to the allocator again before it is placed back in the direct mapping. If another task attempts to allocate the page between (a) and (b), and the kernel tries to access it via the direct map, it would result in a supervisor not-present page fault. Fix the ordering to restore the direct map before the folio is freed. Link: https://lkml.kernel.org/r/20251031120955.92116-1-lance.yang@linux.dev Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas") Signed-off-by: Lance Yang <lance.yang(a)linux.dev> Reported-by: Google Big Sleep <big-sleep-vuln-reports(a)google.com> Closes: https://lore.kernel.org/linux-mm/CAEXGt5QeDpiHTu3K9tvjUTPqo+d-=wuCNYPa+6sWK… Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/secretmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/secretmem.c b/mm/secretmem.c index 88fbd3598207..987def80d810 100644 --- a/mm/secretmem.c +++ b/mm/secretmem.c @@ -84,13 +84,13 @@ static vm_fault_t secretmem_fault(struct vm_fault *vmf) __folio_mark_uptodate(folio); err = filemap_add_folio(mapping, folio, offset, gfp); if (unlikely(err)) { - folio_put(folio); /* * If a split of large page was required, it * already happened when we marked the page invalid * which guarantees that this call won't fail */ set_direct_map_default_noflush(page); + folio_put(folio); if (err == -EEXIST) goto retry; -- 2.43.0

2 1

[PATCH OLK-6.6] mm/page_alloc: change all pageblocks migrate type on coalescing
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Alexander Gordeev <agordeev(a)linux.ibm.com> mainline inclusion from mainline-v6.19-rc4 commit 7838a4eb8a1d23160bd3f588ea7f2b8f7c00c55b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13448 CVE: CVE-2025-71134 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a page is freed it coalesces with a buddy into a higher order page while possible. When the buddy page migrate type differs, it is expected to be updated to match the one of the page being freed. However, only the first pageblock of the buddy page is updated, while the rest of the pageblocks are left unchanged. That causes warnings in later expand() and other code paths (like below), since an inconsistency between migration type of the list containing the page and the page-owned pageblocks migration types is introduced. [ 308.986589] ------------[ cut here ]------------ [ 308.987227] page type is 0, passed migratetype is 1 (nr=256) [ 308.987275] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:812 expand+0x23c/0x270 [ 308.987293] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.987439] Unloaded tainted modules: hmac_s390(E):2 [ 308.987650] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.987657] Tainted: [E]=UNSIGNED_MODULE [ 308.987661] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.987666] Krnl PSW : 0404f00180000000 00000349976fa600 (expand+0x240/0x270) [ 308.987676] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.987682] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.987688] 0000000000000005 0000034980000005 000002be803ac000 0000023efe6c8300 [ 308.987692] 0000000000000008 0000034998d57290 000002be00000100 0000023e00000008 [ 308.987696] 0000000000000000 0000000000000000 00000349976fa5fc 000002c99b1eb6f0 [ 308.987708] Krnl Code: 00000349976fa5f0: c020008a02f2 larl %r2,000003499883abd4 00000349976fa5f6: c0e5ffe3f4b5 brasl %r14,0000034997378f60 #00000349976fa5fc: af000000 mc 0,0 >00000349976fa600: a7f4ff4c brc 15,00000349976fa498 00000349976fa604: b9040026 lgr %r2,%r6 00000349976fa608: c0300088317f larl %r3,0000034998800906 00000349976fa60e: c0e5fffdb6e1 brasl %r14,00000349976b13d0 00000349976fa614: af000000 mc 0,0 [ 308.987734] Call Trace: [ 308.987738] [<00000349976fa600>] expand+0x240/0x270 [ 308.987744] ([<00000349976fa5fc>] expand+0x23c/0x270) [ 308.987749] [<00000349976ff95e>] rmqueue_bulk+0x71e/0x940 [ 308.987754] [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0 [ 308.987759] [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40 [ 308.987763] [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0 [ 308.987768] [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400 [ 308.987774] [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220 [ 308.987781] [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0 [ 308.987786] [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0 [ 308.987791] [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240 [ 308.987799] [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210 [ 308.987804] [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500 [ 308.987809] [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0 [ 308.987813] [<000003499734d70e>] do_exception+0x1de/0x540 [ 308.987822] [<0000034998387390>] __do_pgm_check+0x130/0x220 [ 308.987830] [<000003499839a934>] pgm_check_handler+0x114/0x160 [ 308.987838] 3 locks held by mempig_verify/5224: [ 308.987842] #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0 [ 308.987859] #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40 [ 308.987871] #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940 [ 308.987886] Last Breaking-Event-Address: [ 308.987890] [<0000034997379096>] __warn_printk+0x136/0x140 [ 308.987897] irq event stamp: 52330356 [ 308.987901] hardirqs last enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220 [ 308.987907] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0 [ 308.987913] softirqs last enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530 [ 308.987922] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140 [ 308.987929] ---[ end trace 0000000000000000 ]--- [ 308.987936] ------------[ cut here ]------------ [ 308.987940] page type is 0, passed migratetype is 1 (nr=256) [ 308.987951] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:860 __del_page_from_free_list+0x1be/0x1e0 [ 308.987960] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.988070] Unloaded tainted modules: hmac_s390(E):2 [ 308.988087] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G W E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.988095] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 308.988100] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.988105] Krnl PSW : 0404f00180000000 00000349976f9e32 (__del_page_from_free_list+0x1c2/0x1e0) [ 308.988118] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.988127] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.988133] 0000000000000005 0000034980000005 0000034998d57290 0000023efe6c8300 [ 308.988139] 0000000000000001 0000000000000008 000002be00000100 000002be803ac000 [ 308.988144] 0000000000000000 0000000000000001 00000349976f9e2e 000002c99b1eb728 [ 308.988153] Krnl Code: 00000349976f9e22: c020008a06d9 larl %r2,000003499883abd4 00000349976f9e28: c0e5ffe3f89c brasl %r14,0000034997378f60 #00000349976f9e2e: af000000 mc 0,0 >00000349976f9e32: a7f4ff4e brc 15,00000349976f9cce 00000349976f9e36: b904002b lgr %r2,%r11 00000349976f9e3a: c030008a06e7 larl %r3,000003499883ac08 00000349976f9e40: c0e5fffdbac8 brasl %r14,00000349976b13d0 00000349976f9e46: af000000 mc 0,0 [ 308.988184] Call Trace: [ 308.988188] [<00000349976f9e32>] __del_page_from_free_list+0x1c2/0x1e0 [ 308.988195] ([<00000349976f9e2e>] __del_page_from_free_list+0x1be/0x1e0) [ 308.988202] [<00000349976ff946>] rmqueue_bulk+0x706/0x940 [ 308.988208] [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0 [ 308.988214] [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40 [ 308.988221] [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0 [ 308.988227] [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400 [ 308.988233] [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220 [ 308.988240] [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0 [ 308.988247] [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0 [ 308.988253] [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240 [ 308.988260] [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210 [ 308.988267] [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500 [ 308.988273] [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0 [ 308.988279] [<000003499734d70e>] do_exception+0x1de/0x540 [ 308.988286] [<0000034998387390>] __do_pgm_check+0x130/0x220 [ 308.988293] [<000003499839a934>] pgm_check_handler+0x114/0x160 [ 308.988300] 3 locks held by mempig_verify/5224: [ 308.988305] #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0 [ 308.988322] #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40 [ 308.988334] #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940 [ 308.988346] Last Breaking-Event-Address: [ 308.988350] [<0000034997379096>] __warn_printk+0x136/0x140 [ 308.988356] irq event stamp: 52330356 [ 308.988360] hardirqs last enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220 [ 308.988366] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0 [ 308.988373] softirqs last enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530 [ 308.988380] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140 [ 308.988388] ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20251215081002.3353900A9c-agordeev@linux.ibm.com Link: https://lkml.kernel.org/r/20251212151457.3898073Add-agordeev@linux.ibm.com Fixes: e6cf9e1c4cde ("mm: page_alloc: fix up block types when merging compatible blocks") Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Closes: https://lore.kernel.org/linux-mm/87wmalyktd.fsf@linux.ibm.com/ Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Wei Yang <richard.weiyang(a)gmail.com> Cc: Marc Hartmayer <mhartmay(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/page_allo.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/page_alloc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index b70a7f657853..2bc511aa784c 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -748,6 +748,17 @@ buddy_merge_likely(unsigned long pfn, unsigned long buddy_pfn, NULL) != NULL; } +static void change_pageblock_range(struct page *pageblock_page, + int start_order, int migratetype) +{ + int nr_pageblocks = 1 << (start_order - pageblock_order); + + while (nr_pageblocks--) { + set_pageblock_migratetype(pageblock_page, migratetype); + pageblock_page += pageblock_nr_pages; + } +} + /* * Freeing function for a buddy system allocator. * @@ -835,7 +846,7 @@ static inline void __free_one_page(struct page *page, * expand() down the line puts the sub-blocks * on the right freelists. */ - set_pageblock_migratetype(buddy, migratetype); + change_pageblock_range(buddy, order, migratetype); } combined_pfn = buddy_pfn & pfn; @@ -1813,17 +1824,6 @@ bool move_freepages_block_isolate(struct zone *zone, struct page *page, } #endif /* CONFIG_MEMORY_ISOLATION */ -static void change_pageblock_range(struct page *pageblock_page, - int start_order, int migratetype) -{ - int nr_pageblocks = 1 << (start_order - pageblock_order); - - while (nr_pageblocks--) { - set_pageblock_migratetype(pageblock_page, migratetype); - pageblock_page += pageblock_nr_pages; - } -} - /* * When we are falling back to another migratetype during allocation, should we * try to claim an entire block to satisfy further allocations, instead of -- 2.43.0

2 1

[PATCH OLK-6.6] libceph: make decode_pool() more resilient against corrupted osdmaps
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Ilya Dryomov <idryomov(a)gmail.com> stable inclusion from stable-v6.6.120 commit e927ab132b87ba3f076705fc2684d94b24201ed1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13431 CVE: CVE-2025-71116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8c738512714e8c0aa18f8a10c072d5b01c83db39 upstream. If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or skipped. Cc: stable(a)vger.kernel.org Reported-by: ziming zhang <ezrakiez(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Reviewed-by: Xiubo Li <xiubli(a)redhat.com> Tested-by: ziming zhang <ezrakiez(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/ceph/osdmap.c | 116 +++++++++++++++++++++------------------------- 1 file changed, 52 insertions(+), 64 deletions(-) diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index 295098873861..b0a08a537012 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -806,51 +806,49 @@ static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi) ceph_decode_need(p, end, len, bad); pool_end = *p + len; + ceph_decode_need(p, end, 4 + 4 + 4, bad); pi->type = ceph_decode_8(p); pi->size = ceph_decode_8(p); pi->crush_ruleset = ceph_decode_8(p); pi->object_hash = ceph_decode_8(p); - pi->pg_num = ceph_decode_32(p); pi->pgp_num = ceph_decode_32(p); - *p += 4 + 4; /* skip lpg* */ - *p += 4; /* skip last_change */ - *p += 8 + 4; /* skip snap_seq, snap_epoch */ + /* lpg*, last_change, snap_seq, snap_epoch */ + ceph_decode_skip_n(p, end, 8 + 4 + 8 + 4, bad); /* skip snaps */ - num = ceph_decode_32(p); + ceph_decode_32_safe(p, end, num, bad); while (num--) { - *p += 8; /* snapid key */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* snapid key, pool snap (with versions) */ + ceph_decode_skip_n(p, end, 8 + 2, bad); + ceph_decode_skip_string(p, end, bad); } - /* skip removed_snaps */ - num = ceph_decode_32(p); - *p += num * (8 + 8); + /* removed_snaps */ + ceph_decode_skip_map(p, end, 64, 64, bad); + ceph_decode_need(p, end, 8 + 8 + 4, bad); *p += 8; /* skip auid */ pi->flags = ceph_decode_64(p); *p += 4; /* skip crash_replay_interval */ if (ev >= 7) - pi->min_size = ceph_decode_8(p); + ceph_decode_8_safe(p, end, pi->min_size, bad); else pi->min_size = pi->size - pi->size / 2; if (ev >= 8) - *p += 8 + 8; /* skip quota_max_* */ + /* quota_max_* */ + ceph_decode_skip_n(p, end, 8 + 8, bad); if (ev >= 9) { - /* skip tiers */ - num = ceph_decode_32(p); - *p += num * 8; + /* tiers */ + ceph_decode_skip_set(p, end, 64, bad); + ceph_decode_need(p, end, 8 + 1 + 8 + 8, bad); *p += 8; /* skip tier_of */ *p += 1; /* skip cache_mode */ - pi->read_tier = ceph_decode_64(p); pi->write_tier = ceph_decode_64(p); } else { @@ -858,86 +856,76 @@ static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi) pi->write_tier = -1; } - if (ev >= 10) { - /* skip properties */ - num = ceph_decode_32(p); - while (num--) { - len = ceph_decode_32(p); - *p += len; /* key */ - len = ceph_decode_32(p); - *p += len; /* val */ - } - } + if (ev >= 10) + /* properties */ + ceph_decode_skip_map(p, end, string, string, bad); if (ev >= 11) { - /* skip hit_set_params */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* hit_set_params (with versions) */ + ceph_decode_skip_n(p, end, 2, bad); + ceph_decode_skip_string(p, end, bad); - *p += 4; /* skip hit_set_period */ - *p += 4; /* skip hit_set_count */ + /* hit_set_period, hit_set_count */ + ceph_decode_skip_n(p, end, 4 + 4, bad); } if (ev >= 12) - *p += 4; /* skip stripe_width */ + /* stripe_width */ + ceph_decode_skip_32(p, end, bad); - if (ev >= 13) { - *p += 8; /* skip target_max_bytes */ - *p += 8; /* skip target_max_objects */ - *p += 4; /* skip cache_target_dirty_ratio_micro */ - *p += 4; /* skip cache_target_full_ratio_micro */ - *p += 4; /* skip cache_min_flush_age */ - *p += 4; /* skip cache_min_evict_age */ - } + if (ev >= 13) + /* target_max_*, cache_target_*, cache_min_* */ + ceph_decode_skip_n(p, end, 16 + 8 + 8, bad); - if (ev >= 14) { - /* skip erasure_code_profile */ - len = ceph_decode_32(p); - *p += len; - } + if (ev >= 14) + /* erasure_code_profile */ + ceph_decode_skip_string(p, end, bad); /* * last_force_op_resend_preluminous, will be overridden if the * map was encoded with RESEND_ON_SPLIT */ if (ev >= 15) - pi->last_force_request_resend = ceph_decode_32(p); + ceph_decode_32_safe(p, end, pi->last_force_request_resend, bad); else pi->last_force_request_resend = 0; if (ev >= 16) - *p += 4; /* skip min_read_recency_for_promote */ + /* min_read_recency_for_promote */ + ceph_decode_skip_32(p, end, bad); if (ev >= 17) - *p += 8; /* skip expected_num_objects */ + /* expected_num_objects */ + ceph_decode_skip_64(p, end, bad); if (ev >= 19) - *p += 4; /* skip cache_target_dirty_high_ratio_micro */ + /* cache_target_dirty_high_ratio_micro */ + ceph_decode_skip_32(p, end, bad); if (ev >= 20) - *p += 4; /* skip min_write_recency_for_promote */ + /* min_write_recency_for_promote */ + ceph_decode_skip_32(p, end, bad); if (ev >= 21) - *p += 1; /* skip use_gmt_hitset */ + /* use_gmt_hitset */ + ceph_decode_skip_8(p, end, bad); if (ev >= 22) - *p += 1; /* skip fast_read */ + /* fast_read */ + ceph_decode_skip_8(p, end, bad); - if (ev >= 23) { - *p += 4; /* skip hit_set_grade_decay_rate */ - *p += 4; /* skip hit_set_search_last_n */ - } + if (ev >= 23) + /* hit_set_grade_decay_rate, hit_set_search_last_n */ + ceph_decode_skip_n(p, end, 4 + 4, bad); if (ev >= 24) { - /* skip opts */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* opts (with versions) */ + ceph_decode_skip_n(p, end, 2, bad); + ceph_decode_skip_string(p, end, bad); } if (ev >= 25) - pi->last_force_request_resend = ceph_decode_32(p); + ceph_decode_32_safe(p, end, pi->last_force_request_resend, bad); /* ignore the rest */ -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix NFS deadlock
by Li Lingfeng 03 Feb '26

03 Feb '26

Revert the patch from hulk and apply the one from mainline. Trond Myklebust (1): NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong (1): Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" fs/nfs/file.c | 11 +++++++++-- fs/nfs/nfstrace.h | 3 +++ fs/nfs/write.c | 33 +++++++++++++++++++++++++++++++++ include/linux/nfs_fs.h | 1 + 4 files changed, 46 insertions(+), 2 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/1] CVE-2025-68172
by Liu Mingrui 03 Feb '26

03 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2025-68172 Haotian Zhang (1): crypto: aspeed - fix double free caused by devm drivers/crypto/aspeed/aspeed-acry.c | 2 -- 1 file changed, 2 deletions(-) -- 2.34.1

2 2